theory Ipc_C

lemma copyMRsFaultReply_ccorres_exception:
  "ccorres dc xfdc
           (valid_pspace' and tcb_at' s
                          and tcb_at' r
                          and obj_at' (\<lambda>t. tcbFault t = Some f) r
                          and K (r \<noteq> s)
                          and K (len \<le> unat n_exceptionMessage))
           (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace>
                 \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace>
                 \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception \<rbrace>
                 \<inter> \<lbrace>\<acute>length___unsigned_long = of_nat len \<rbrace>) hs
           (do t \<leftarrow> getSanitiseRegisterInfo r;
               zipWithM_x (\<lambda>rs rd. do v \<leftarrow> asUser s (getRegister rs);
                                        asUser r (setRegister rd (ARM_H.sanitiseRegister t rd v))
                                        od)
               ARM_H.msgRegisters (take len ARM_H.exceptionMessage)
            od)
           (Call copyMRsFaultReply_'proc)" proof - show ?thesis apply (unfold K_def, rule ccorres_gen_asm) apply (cinit' lift: sender_' receiver_'
                        id___anonymous_enum_'
                        length___unsigned_long_'
                  simp: whileAnno_def) apply (ctac(no_vcg) add: Arch_getSanitiseRegisterInfo_ccorres) apply (rule ccorres_rhs_assoc2) apply (simp add: MessageID_Exception_def) apply ccorres_rewrite apply (rule ccorres_add_return2) apply (rule ccorres_split_nothrow_novcg) apply (rule ccorres_zipWithM_x_while) apply clarsimp apply (intro ccorres_rhs_assoc) apply (rule ccorres_symb_exec_r) apply ctac apply (rule ccorres_symb_exec_r) apply ctac apply vcg apply (rule conseqPre, vcg) apply fastforce apply wp apply vcg apply vcg apply (rule conjI, simp add: ARM_H.exceptionMessage_def
                                           ARM.exceptionMessage_def word_of_nat_less) apply (simp add: msgRegisters_ccorres n_msgRegisters_def length_msgRegisters
                               unat_of_nat exceptionMessage_ccorres[symmetric,simplified MessageID_Exception_def,simplified]
                               n_exceptionMessage_def length_exceptionMessage sanitiseRegister_def) apply (simp add: word_less_nat_alt unat_of_nat) apply (rule conseqPre, vcg) apply (clarsimp simp: word_of_nat_less ARM_H.exceptionMessage_def
                                   ARM.exceptionMessage_def) apply (simp add: min_def length_msgRegisters) apply (clarsimp simp: min_def n_exceptionMessage_def
                                  ARM_H.exceptionMessage_def
                                  ARM.exceptionMessage_def
                                  length_msgRegisters n_msgRegisters_def
                                  message_info_to_H_def word_of_nat_less
                           split: if_split) apply (fastforce dest!: le_antisym) apply clarsimp apply (vcg spec=TrueI) apply clarsimp apply wp apply simp+ apply (clarsimp simp: ARM_H.exceptionMessage_def
                               ARM.exceptionMessage_def
                               word_bits_def) apply unat_arith apply ceqv apply (simp add: length_exceptionMessage
                        length_msgRegisters
                        n_exceptionMessage_def
                        msgMaxLength_def
                        n_msgRegisters_def
                        of_nat_less_iff) apply ccorres_rewrite apply (rule ccorres_return_Skip) apply (wp mapM_wp') apply clarsimp+ apply (clarsimp simp: guard_is_UNIV_def message_info_to_H_def
                           Collect_const_mem
                    split: if_split) apply wpsimp+ done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and K (r \<noteq> s) and K (len \<le> unat n_exceptionMessage)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat len\<rbrace>) hs (do t <- local.getSanitiseRegisterInfo r;
zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage)
od) (Call copyMRsFaultReply_'proc) proof (state)
goal (1 subgoal):
 1. ccorres dc xfdc (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and K (r \<noteq> s) and K (len \<le> unat n_exceptionMessage)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat len\<rbrace>) hs (do t <- local.getSanitiseRegisterInfo r;
zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage)
od) (Call copyMRsFaultReply_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and K (r \<noteq> s) and K (len \<le> unat n_exceptionMessage)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat len\<rbrace>) hs (do t <- local.getSanitiseRegisterInfo r;
zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage)
od) (Call copyMRsFaultReply_'proc) proof (prove)
goal (1 subgoal):
 1. len \<le> unat n_exceptionMessage \<Longrightarrow> ccorres dc xfdc (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat len\<rbrace>) hs (do t <- local.getSanitiseRegisterInfo r;
zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage)
od) (Call copyMRsFaultReply_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1923 length___unsigned_long id___anonymous_enum receiver sender) (?Q'1923 length___unsigned_long id___anonymous_enum receiver sender) (SKIP # hs) (do t <- local.getSanitiseRegisterInfo r;
zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage)
od) (\<acute>archInfo :== CALL Arch_getSanitiseRegisterInfo_'proc(receiver);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < (if length___unsigned_long < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>id___anonymous_enum <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s id___anonymous_enum\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[unat id___anonymous_enum].[unat \<acute>i])));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(sender,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,\<acute>v,\<acute>archInfo);;
CALL setRegister_'proc(receiver,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1);;
IF \<acute>i < length___unsigned_long THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,sender);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < length___unsigned_long\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>id___anonymous_enum <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s id___anonymous_enum\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[unat id___anonymous_enum].[unat \<acute>i])));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,\<acute>v,\<acute>archInfo);;
CALL setRegister_'proc(receiver,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI)))
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1923 length___unsigned_long id___anonymous_enum receiver sender sa \<and> s' \<in> ?Q'1923 length___unsigned_long id___anonymous_enum receiver sender proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; ((=) \<circ> from_bool) rv archInfo\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1931 length___unsigned_long id___anonymous_enum receiver sender rv) (?Q'1931 length___unsigned_long id___anonymous_enum receiver sender rv archInfo) (SKIP # hs) (zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage)) (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < (if length___unsigned_long < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>id___anonymous_enum <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s id___anonymous_enum\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[unat id___anonymous_enum].[unat \<acute>i])));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(sender,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,\<acute>v,archInfo);;
CALL setRegister_'proc(receiver,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1);;
IF \<acute>i < length___unsigned_long THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,sender);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < length___unsigned_long\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>id___anonymous_enum <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s id___anonymous_enum\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[unat id___anonymous_enum].[unat \<acute>i])));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,\<acute>v,archInfo);;
CALL setRegister_'proc(receiver,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI))
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>?Q1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?Q'1931 length___unsigned_long id___anonymous_enum receiver sender rv (ret__unsigned_long_' t)} proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; ((=) \<circ> from_bool) rv archInfo\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1931 length___unsigned_long id___anonymous_enum receiver sender rv) (?Q'1931 length___unsigned_long id___anonymous_enum receiver sender rv archInfo) (SKIP # hs) (zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage)) (\<acute>i :== 0;;
While \<lbrace>\<acute>i < (if length___unsigned_long < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>id___anonymous_enum <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s id___anonymous_enum\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[unat id___anonymous_enum].[unat \<acute>i])));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(sender,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,\<acute>v,archInfo);;
CALL setRegister_'proc(receiver,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1);;
IF \<acute>i < length___unsigned_long THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,sender);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < length___unsigned_long\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>id___anonymous_enum <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s id___anonymous_enum\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[unat id___anonymous_enum].[unat \<acute>i])));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,\<acute>v,archInfo);;
CALL setRegister_'proc(receiver,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI)
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>?Q1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?Q'1931 length___unsigned_long id___anonymous_enum receiver sender rv (ret__unsigned_long_' t)} proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1931 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv) (?Q'1931 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo) (SKIP # hs) (zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage)) (\<acute>i :== 0;;
While \<lbrace>\<acute>i < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds UNIV (Guard ArrayBounds UNIV (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i])));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1);;
IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds UNIV (Guard ArrayBounds UNIV (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i])));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI)
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>?Q1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?Q'1931 length___unsigned_long id___anonymous_enum receiver sender rv (ret__unsigned_long_' t)} proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1931 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv) (?Q'1931 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo) (SKIP # hs) (zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage)) (\<acute>i :== 0;;
While \<lbrace>\<acute>i < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1);;
IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI)
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>?Q1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?Q'1931 length___unsigned_long id___anonymous_enum receiver sender rv (ret__unsigned_long_' t)} proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1931 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv) (?Q'1931 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo) (SKIP # hs) (zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage) >>= return) (\<acute>i :== 0;;
While \<lbrace>\<acute>i < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1);;
IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI)
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>?Q1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?Q'1931 length___unsigned_long id___anonymous_enum receiver sender rv (ret__unsigned_long_' t)} proof (prove)
goal (7 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ccorres (?r'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo) (?xf'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo) (?P3013 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv) (?Q'1931 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo) [] (zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage)) (\<acute>i :== 0;;
While \<lbrace>\<acute>i < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1))
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo) rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; ?r'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x) (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv') (SKIP # hs) (return x) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3011 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage) \<lbrace>?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo) (?xf'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo) (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. ?P3013 length___unsigned_long id___anonymous_enum receiver sender a and ?R3011 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?Q'1931 length___unsigned_long id___anonymous_enum receiver sender rv (ret__unsigned_long_' t)} proof (prove)
goal (11 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>n. n < length TCB_H.msgRegisters \<and> n < length (take len FaultHandler_H.exceptionMessage) \<longrightarrow> ccorres dc xfdc (?F3023 rv n) \<lbrace>\<acute>i = word_of_nat n\<rbrace> [] (do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.exceptionMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.exceptionMessage ! n) v))
od) (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long))
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))))
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.exceptionMessage)\<rbrakk> \<Longrightarrow> \<lbrace>?F3023 rv n\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.exceptionMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.exceptionMessage ! n) v))
od \<lbrace>\<lambda>_. ?F3023 rv (Suc n)\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)) < 2 ^ word_bits
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x) (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv') (SKIP # hs) (return x) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3011 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage) \<lbrace>?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))) i_' (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. ?P3013 length___unsigned_long id___anonymous_enum receiver sender a and ?R3011 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
A total of 11 subgoals...
flex-flex pairs:
\<lambda>rv. ?F3023 rv 0 \<equiv>\<^sup>? ?P3013 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) proof (prove)
goal (11 subgoals):
 1. \<And>rv n. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?F3023 rv n) \<lbrace>\<acute>i = word_of_nat n\<rbrace> [] (do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (FaultHandler_H.exceptionMessage ! n) (local.sanitiseRegister rv (FaultHandler_H.exceptionMessage ! n) v))
od) (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long))
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))))
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.exceptionMessage)\<rbrakk> \<Longrightarrow> \<lbrace>?F3023 rv n\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.exceptionMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.exceptionMessage ! n) v))
od \<lbrace>\<lambda>_. ?F3023 rv (Suc n)\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)) < 2 ^ word_bits
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x) (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv') (SKIP # hs) (return x) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3011 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage) \<lbrace>?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))) i_' (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. ?P3013 length___unsigned_long id___anonymous_enum receiver sender a and ?R3011 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
A total of 11 subgoals...
flex-flex pairs:
\<lambda>rv. ?F3023 rv 0 \<equiv>\<^sup>? ?P3013 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) proof (prove)
goal (11 subgoals):
 1. \<And>rv n. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?F3023 rv n) \<lbrace>\<acute>i = word_of_nat n\<rbrace> [] (do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (FaultHandler_H.exceptionMessage ! n) (local.sanitiseRegister rv (FaultHandler_H.exceptionMessage ! n) v))
od) (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
(Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
(\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long))))
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))))
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.exceptionMessage)\<rbrakk> \<Longrightarrow> \<lbrace>?F3023 rv n\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.exceptionMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.exceptionMessage ! n) v))
od \<lbrace>\<lambda>_. ?F3023 rv (Suc n)\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)) < 2 ^ word_bits
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x) (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv') (SKIP # hs) (return x) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3011 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage) \<lbrace>?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))) i_' (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. ?P3013 length___unsigned_long id___anonymous_enum receiver sender a and ?R3011 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
A total of 11 subgoals...
flex-flex pairs:
\<lambda>rv. ?F3023 rv 0 \<equiv>\<^sup>? ?P3013 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) proof (prove)
goal (13 subgoals):
 1. \<And>rv n. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?F3023 rv n) (?Q'3045 rv n) [] (do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (FaultHandler_H.exceptionMessage ! n) (local.sanitiseRegister rv (FaultHandler_H.exceptionMessage ! n) v))
od) (Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
(\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long)))
 2. \<And>rv n. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> \<lbrace>\<acute>i = word_of_nat n\<rbrace> Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]) (?Q'3045 rv n)
 3. \<And>rv n s. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len; ?F3023 rv n s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<acute>i = word_of_nat n\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))))
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.exceptionMessage)\<rbrakk> \<Longrightarrow> \<lbrace>?F3023 rv n\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.exceptionMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.exceptionMessage ! n) v))
od \<lbrace>\<lambda>_. ?F3023 rv (Suc n)\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)) < 2 ^ word_bits
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x) (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv') (SKIP # hs) (return x) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3011 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage) \<lbrace>?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
A total of 13 subgoals...
flex-flex pairs:
\<lambda>rv. ?F3023 rv 0 \<equiv>\<^sup>? ?P3013 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) proof (prove)
goal (15 subgoals):
 1. \<And>rv n rva v. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len; rva = v\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3052 rv n rva) (?Q'3052 rv n rva v) [] (asUser r (setRegister (FaultHandler_H.exceptionMessage ! n) (local.sanitiseRegister rv (FaultHandler_H.exceptionMessage ! n) rva))) (\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv,v);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long))
 2. \<And>rv n. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len\<rbrakk> \<Longrightarrow> \<lbrace>?R3052 rv n\<rbrace> asUser s (getRegister (TCB_H.msgRegisters ! n)) \<lbrace>?Q3052 rv n\<rbrace>
 3. \<And>rv n. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3052 rv n) \<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]) {s. \<forall>rva. rva = v_' s \<longrightarrow> s \<in> ?Q'3052 rv n rva (v_' s)}
 4. \<And>rv n. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> \<lbrace>\<acute>i = word_of_nat n\<rbrace> Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]) ({sa. reg_'_update (\<lambda>_. kernel_all_global_addresses.msgRegisters.[unat (i_' sa)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (TCB_H.msgRegisters ! n)\<rbrace>} \<inter> ?R'3052 rv n \<inter> \<lbrace>\<acute>i < 4\<rbrace>)
 5. \<And>rv n s. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len; ((\<lambda>_. True) and ?R3052 rv n) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<acute>i = word_of_nat n\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))))
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.exceptionMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and ?R3052 rv n\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.exceptionMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.exceptionMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and ?R3052 rv (Suc n)\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)) < 2 ^ word_bits
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
A total of 15 subgoals...
flex-flex pairs:
?R3057 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) \<equiv>\<^sup>? \<lambda>rv. ?R3052 rv 0 proof (prove)
goal (17 subgoals):
 1. \<And>rv n rva v. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len; rva = v\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3052 rv n rva) (?Q'3144 rv n rva v) [] (asUser r (setRegister (FaultHandler_H.exceptionMessage ! n) (local.sanitiseRegister rv (FaultHandler_H.exceptionMessage ! n) rva))) (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long))
 2. \<And>rv n rva v. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len; rva = v\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3052 rv n rva v) \<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv,v) (?Q'3144 rv n rva v)
 3. \<And>rv n rva v s. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len; rva = v; ?Q3052 rv n rva s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3052 rv n rva v \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv,v) {s'. (s, s') \<in> rf_sr}
 4. \<And>rv n. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len\<rbrakk> \<Longrightarrow> \<lbrace>?R3052 rv n\<rbrace> asUser s (getRegister (TCB_H.msgRegisters ! n)) \<lbrace>?Q3052 rv n\<rbrace>
 5. \<And>rv n. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3052 rv n) \<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]) {s. \<forall>rva. rva = v_' s \<longrightarrow> s \<in> ?Q'3052 rv n rva (v_' s)}
 6. \<And>rv n. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> \<lbrace>\<acute>i = word_of_nat n\<rbrace> Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]) ({sa. reg_'_update (\<lambda>_. kernel_all_global_addresses.msgRegisters.[unat (i_' sa)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (TCB_H.msgRegisters ! n)\<rbrace>} \<inter> ?R'3052 rv n \<inter> \<lbrace>\<acute>i < 4\<rbrace>)
 7. \<And>rv n s. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len; ((\<lambda>_. True) and ?R3052 rv n) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<acute>i = word_of_nat n\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))))
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.exceptionMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and ?R3052 rv n\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.exceptionMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.exceptionMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and ?R3052 rv (Suc n)\<rbrace>
A total of 17 subgoals...
flex-flex pairs:
?R3057 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) \<equiv>\<^sup>? \<lambda>rv. ?R3052 rv 0 proof (prove)
goal (16 subgoals):
 1. \<And>rv n rva v. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len; rva = v\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3052 rv n rva v) \<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv,v) {s. w_'_update (\<lambda>_. ret__unsigned_long_' s) (reg_'_update (\<lambda>_. r_' s) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr r) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (FaultHandler_H.exceptionMessage ! n)\<rbrace> \<inter> \<lbrace>\<acute>w = local.sanitiseRegister rv (FaultHandler_H.exceptionMessage ! n) rva\<rbrace>}
 2. \<And>rv n rva v s. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len; rva = v; True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3052 rv n rva v \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv,v) {s'. (s, s') \<in> rf_sr}
 3. \<And>rv n. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len\<rbrakk> \<Longrightarrow> \<lbrace>?R3052 rv n\<rbrace> asUser s (getRegister (TCB_H.msgRegisters ! n)) \<lbrace>\<lambda>a b. True\<rbrace>
 4. \<And>rv n. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3052 rv n) \<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]) {s. \<forall>rva. rva = v_' s \<longrightarrow> s \<in> ?Q'3052 rv n rva (v_' s)}
 5. \<And>rv n. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> \<lbrace>\<acute>i = word_of_nat n\<rbrace> Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]) ({sa. reg_'_update (\<lambda>_. kernel_all_global_addresses.msgRegisters.[unat (i_' sa)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (TCB_H.msgRegisters ! n)\<rbrace>} \<inter> ?R'3052 rv n \<inter> \<lbrace>\<acute>i < 4\<rbrace>)
 6. \<And>rv n s. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len; ((\<lambda>_. True) and ?R3052 rv n) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<acute>i = word_of_nat n\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))))
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.exceptionMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and ?R3052 rv n\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.exceptionMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.exceptionMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and ?R3052 rv (Suc n)\<rbrace>
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)) < 2 ^ word_bits
A total of 16 subgoals...
flex-flex pairs:
?R3057 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) \<equiv>\<^sup>? \<lambda>rv. ?R3052 rv 0 proof (prove)
goal (15 subgoals):
 1. \<And>rv n rva v s. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len; rva = v; True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<exists>t ra. \<acute>r = register_from_H ra \<and> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = local.sanitiseRegister t ra v \<longrightarrow> \<acute>r = register_from_H (FaultHandler_H.exceptionMessage ! n) \<and> local.sanitiseRegister t ra v = local.sanitiseRegister rv (FaultHandler_H.exceptionMessage ! n) rva)\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv,v) {s'. (s, s') \<in> rf_sr}
 2. \<And>rv n. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len\<rbrakk> \<Longrightarrow> \<lbrace>?R3052 rv n\<rbrace> asUser s (getRegister (TCB_H.msgRegisters ! n)) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>rv n. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3052 rv n) \<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]) {s. \<forall>rva. rva = v_' s \<longrightarrow> s \<in> \<lbrace>\<exists>t ra. \<acute>r = register_from_H ra \<and> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = local.sanitiseRegister t ra \<^bsup>s\<^esup>v \<longrightarrow> \<acute>r = register_from_H (FaultHandler_H.exceptionMessage ! n) \<and> local.sanitiseRegister t ra \<^bsup>s\<^esup>v = local.sanitiseRegister rv (FaultHandler_H.exceptionMessage ! n) rva)\<rbrace>}
 4. \<And>rv n. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> \<lbrace>\<acute>i = word_of_nat n\<rbrace> Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]) ({sa. reg_'_update (\<lambda>_. kernel_all_global_addresses.msgRegisters.[unat (i_' sa)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (TCB_H.msgRegisters ! n)\<rbrace>} \<inter> ?R'3052 rv n \<inter> \<lbrace>\<acute>i < 4\<rbrace>)
 5. \<And>rv n s. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len; ((\<lambda>_. True) and ?R3052 rv n) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<acute>i = word_of_nat n\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))))
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.exceptionMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and ?R3052 rv n\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.exceptionMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.exceptionMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and ?R3052 rv (Suc n)\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)) < 2 ^ word_bits
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
A total of 15 subgoals...
flex-flex pairs:
?R3057 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) \<equiv>\<^sup>? \<lambda>rv. ?R3052 rv 0 proof (prove)
goal (15 subgoals):
 1. \<And>rv n rva v s. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len; rva = v; True\<rbrakk> \<Longrightarrow> \<lbrace>\<exists>t ra. \<acute>r = register_from_H ra \<and> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = local.sanitiseRegister t ra v \<longrightarrow> \<acute>r = register_from_H (FaultHandler_H.exceptionMessage ! n) \<and> local.sanitiseRegister t ra v = local.sanitiseRegister rv (FaultHandler_H.exceptionMessage ! n) rva)\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. \<exists>t r. r_' sa = register_from_H r \<and> (\<forall>ta. ret__unsigned_long_' ta = local.sanitiseRegister t r v \<longrightarrow> (s, sa\<lparr>ret__unsigned_long_' := local.sanitiseRegister t r v\<rparr>) \<in> rf_sr)}
 2. \<And>rv n. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len\<rbrakk> \<Longrightarrow> \<lbrace>?R3052 rv n\<rbrace> asUser s (getRegister (TCB_H.msgRegisters ! n)) \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>rv n. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3052 rv n) \<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]) {s. \<forall>rva. rva = v_' s \<longrightarrow> s \<in> \<lbrace>\<exists>t ra. \<acute>r = register_from_H ra \<and> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = local.sanitiseRegister t ra \<^bsup>s\<^esup>v \<longrightarrow> \<acute>r = register_from_H (FaultHandler_H.exceptionMessage ! n) \<and> local.sanitiseRegister t ra \<^bsup>s\<^esup>v = local.sanitiseRegister rv (FaultHandler_H.exceptionMessage ! n) rva)\<rbrace>}
 4. \<And>rv n. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> \<lbrace>\<acute>i = word_of_nat n\<rbrace> Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]) ({sa. reg_'_update (\<lambda>_. kernel_all_global_addresses.msgRegisters.[unat (i_' sa)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (TCB_H.msgRegisters ! n)\<rbrace>} \<inter> ?R'3052 rv n \<inter> \<lbrace>\<acute>i < 4\<rbrace>)
 5. \<And>rv n s. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len; ((\<lambda>_. True) and ?R3052 rv n) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<acute>i = word_of_nat n\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))))
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.exceptionMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and ?R3052 rv n\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.exceptionMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.exceptionMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and ?R3052 rv (Suc n)\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)) < 2 ^ word_bits
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
A total of 15 subgoals...
flex-flex pairs:
?R3057 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) \<equiv>\<^sup>? \<lambda>rv. ?R3052 rv 0 proof (prove)
goal (14 subgoals):
 1. \<And>rv n. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len\<rbrakk> \<Longrightarrow> \<lbrace>?R3052 rv n\<rbrace> asUser s (getRegister (TCB_H.msgRegisters ! n)) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>rv n. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3052 rv n) \<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]) {s. \<forall>rva. rva = v_' s \<longrightarrow> s \<in> \<lbrace>\<exists>t ra. \<acute>r = register_from_H ra \<and> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = local.sanitiseRegister t ra \<^bsup>s\<^esup>v \<longrightarrow> \<acute>r = register_from_H (FaultHandler_H.exceptionMessage ! n) \<and> local.sanitiseRegister t ra \<^bsup>s\<^esup>v = local.sanitiseRegister rv (FaultHandler_H.exceptionMessage ! n) rva)\<rbrace>}
 3. \<And>rv n. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> \<lbrace>\<acute>i = word_of_nat n\<rbrace> Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]) ({sa. reg_'_update (\<lambda>_. kernel_all_global_addresses.msgRegisters.[unat (i_' sa)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (TCB_H.msgRegisters ! n)\<rbrace>} \<inter> ?R'3052 rv n \<inter> \<lbrace>\<acute>i < 4\<rbrace>)
 4. \<And>rv n s. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len; ((\<lambda>_. True) and ?R3052 rv n) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<acute>i = word_of_nat n\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))))
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.exceptionMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and ?R3052 rv n\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.exceptionMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.exceptionMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and ?R3052 rv (Suc n)\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)) < 2 ^ word_bits
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x) (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv') (SKIP # hs) (return x) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
A total of 14 subgoals...
flex-flex pairs:
?R3057 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) \<equiv>\<^sup>? \<lambda>rv. ?R3052 rv 0 proof (prove)
goal (13 subgoals):
 1. \<And>rv n. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3052 rv n) \<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]) {s. \<forall>rva. rva = v_' s \<longrightarrow> s \<in> \<lbrace>\<exists>t ra. \<acute>r = register_from_H ra \<and> (\<forall>ta. \<^bsup>ta\<^esup>ret__unsigned_long = local.sanitiseRegister t ra \<^bsup>s\<^esup>v \<longrightarrow> \<acute>r = register_from_H (FaultHandler_H.exceptionMessage ! n) \<and> local.sanitiseRegister t ra \<^bsup>s\<^esup>v = local.sanitiseRegister rv (FaultHandler_H.exceptionMessage ! n) rva)\<rbrace>}
 2. \<And>rv n. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> \<lbrace>\<acute>i = word_of_nat n\<rbrace> Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]) ({sa. reg_'_update (\<lambda>_. kernel_all_global_addresses.msgRegisters.[unat (i_' sa)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (TCB_H.msgRegisters ! n)\<rbrace>} \<inter> ?R'3052 rv n \<inter> \<lbrace>\<acute>i < 4\<rbrace>)
 3. \<And>rv n s. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len; ((\<lambda>_. True) and (\<lambda>s. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<acute>i = word_of_nat n\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))))
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.exceptionMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and (\<lambda>s. True)\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.exceptionMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.exceptionMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)) < 2 ^ word_bits
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x) (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv') (SKIP # hs) (return x) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3011 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage) \<lbrace>?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv n. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> \<lbrace>\<acute>i = word_of_nat n\<rbrace> Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]) ({sa. reg_'_update (\<lambda>_. kernel_all_global_addresses.msgRegisters.[unat (i_' sa)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr s) sa) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (TCB_H.msgRegisters ! n)\<rbrace>} \<inter> {sa. kernel_all_global_addresses.msgRegisters.[unat (i_' sa)] < SCAST(32 signed \<rightarrow> 32) 0x14 \<longrightarrow> sa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr s \<longrightarrow> (\<exists>t r. r_' sa = register_from_H r \<and> (\<forall>ta. ret__unsigned_long_' ta = local.sanitiseRegister t r (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr s\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (kernel_all_global_addresses.msgRegisters.[unat (i_' sa)])]) \<longrightarrow> r_' sa = register_from_H (FaultHandler_H.exceptionMessage ! n) \<and> local.sanitiseRegister t r (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr s\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (kernel_all_global_addresses.msgRegisters.[unat (i_' sa)])]) = local.sanitiseRegister rv (FaultHandler_H.exceptionMessage ! n) (h_val (hrs_mem (t_hrs_' (globals sa))) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr s\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (kernel_all_global_addresses.msgRegisters.[unat (i_' sa)])])))} \<inter> \<lbrace>\<acute>i < 4\<rbrace>)
 2. \<And>rv n s. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len; ((\<lambda>_. True) and (\<lambda>s. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<acute>i = word_of_nat n\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))))
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.exceptionMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and (\<lambda>s. True)\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.exceptionMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.exceptionMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)) < 2 ^ word_bits
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x) (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv') (SKIP # hs) (return x) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3011 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage) \<lbrace>?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))) i_' (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv n t_hrs i. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len; i = word_of_nat n\<rbrakk> \<Longrightarrow> i < 0xC \<and> kernel_all_global_addresses.msgRegisters.[unat i] = register_from_H (TCB_H.msgRegisters ! n) \<and> (kernel_all_global_addresses.msgRegisters.[unat i] < SCAST(32 signed \<rightarrow> 32) 0x14 \<longrightarrow> hrs_htd t_hrs \<Turnstile>\<^sub>t tcb_ptr_to_ctcb_ptr s \<longrightarrow> (\<exists>t r. kernel_all_global_addresses.fault_messages.[Suc 0].[unat i] = register_from_H r \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = local.sanitiseRegister t r (h_val (hrs_mem t_hrs) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr s\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (kernel_all_global_addresses.msgRegisters.[unat i])]) \<longrightarrow> kernel_all_global_addresses.fault_messages.[Suc 0].[unat i] = register_from_H (FaultHandler_H.exceptionMessage ! n) \<and> local.sanitiseRegister t r (h_val (hrs_mem t_hrs) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr s\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (kernel_all_global_addresses.msgRegisters.[unat i])]) = local.sanitiseRegister rv (FaultHandler_H.exceptionMessage ! n) (h_val (hrs_mem t_hrs) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr s\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (kernel_all_global_addresses.msgRegisters.[unat i])])))) \<and> i < 4
 2. \<And>rv n s. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len; ((\<lambda>_. True) and (\<lambda>s. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<acute>i = word_of_nat n\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))))
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.exceptionMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and (\<lambda>s. True)\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.exceptionMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.exceptionMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)) < 2 ^ word_bits
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x) (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv') (SKIP # hs) (return x) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3011 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage) \<lbrace>?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))) i_' (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv n t_hrs i. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len; i = word_of_nat n\<rbrakk> \<Longrightarrow> kernel_all_global_addresses.msgRegisters.[unat i] = register_from_H (TCB_H.msgRegisters ! n) \<and> (kernel_all_global_addresses.msgRegisters.[unat i] < SCAST(32 signed \<rightarrow> 32) 0x14 \<longrightarrow> hrs_htd t_hrs \<Turnstile>\<^sub>t tcb_ptr_to_ctcb_ptr s \<longrightarrow> (\<exists>t r. kernel_all_global_addresses.fault_messages.[Suc 0].[unat i] = register_from_H r \<and> (\<forall>ret__unsigned_long. ret__unsigned_long = local.sanitiseRegister t r (h_val (hrs_mem t_hrs) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr s\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (kernel_all_global_addresses.msgRegisters.[unat i])]) \<longrightarrow> kernel_all_global_addresses.fault_messages.[Suc 0].[unat i] = register_from_H (FaultHandler_H.exceptionMessage ! n) \<and> local.sanitiseRegister t r (h_val (hrs_mem t_hrs) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr s\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (kernel_all_global_addresses.msgRegisters.[unat i])]) = local.sanitiseRegister rv (FaultHandler_H.exceptionMessage ! n) (h_val (hrs_mem t_hrs) (PTR(32 word[20]) &(PTR(user_context_C) &(PTR(arch_tcb_C) &(tcb_ptr_to_ctcb_ptr s\<rightarrow>[''tcbArch_C''])\<rightarrow>[''tcbContext_C''])\<rightarrow>[''registers_C''])).[unat (kernel_all_global_addresses.msgRegisters.[unat i])])))) \<and> i < 4
 2. \<And>rv n s. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len; ((\<lambda>_. True) and (\<lambda>s. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<acute>i = word_of_nat n\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))))
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.exceptionMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and (\<lambda>s. True)\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.exceptionMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.exceptionMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)) < 2 ^ word_bits
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x) (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv') (SKIP # hs) (return x) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3011 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage) \<lbrace>?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))) i_' (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>n i. \<lbrakk>len \<le> 3; n < len; i = word_of_nat n\<rbrakk> \<Longrightarrow> word_of_nat n < 4
 2. \<And>rv n s. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len; ((\<lambda>_. True) and (\<lambda>s. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<acute>i = word_of_nat n\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))))
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.exceptionMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and (\<lambda>s. True)\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.exceptionMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.exceptionMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)) < 2 ^ word_bits
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x) (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv') (SKIP # hs) (return x) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3011 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage) \<lbrace>?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))) i_' (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv n s. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len; ((\<lambda>_. True) and (\<lambda>s. True)) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<acute>i = word_of_nat n\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]) {s'. (s, s') \<in> rf_sr}
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))))
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.exceptionMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and (\<lambda>s. True)\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.exceptionMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.exceptionMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)) < 2 ^ word_bits
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x) (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv') (SKIP # hs) (return x) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3011 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage) \<lbrace>?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))) i_' (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3011 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv n s. \<lbrakk>len \<le> unat n_exceptionMessage; n < length TCB_H.msgRegisters; n < length FaultHandler_H.exceptionMessage; n < len; ((\<lambda>_. True) and (\<lambda>s. True)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<acute>i = word_of_nat n\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. i_' sa < 0xC \<and> (s, r_'_update (\<lambda>_. kernel_all_global_addresses.fault_messages.[Suc 0].[unat (i_' sa)]) sa) \<in> rf_sr}
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))))
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.exceptionMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and (\<lambda>s. True)\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.exceptionMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.exceptionMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)) < 2 ^ word_bits
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x) (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv') (SKIP # hs) (return x) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3011 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage) \<lbrace>?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))) i_' (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3011 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))))
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.exceptionMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and (\<lambda>s. True)\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.exceptionMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.exceptionMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)) < 2 ^ word_bits
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x) (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv') (SKIP # hs) (return x) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3011 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage) \<lbrace>?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))) i_' (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3011 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> (n < (if word_of_nat len < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (if unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) \<le> (if length FaultHandler_H.exceptionMessage \<le> len then length FaultHandler_H.exceptionMessage else len) then unat (SCAST(32 signed \<rightarrow> 32) n_msgRegisters) else if length FaultHandler_H.exceptionMessage \<le> len then length FaultHandler_H.exceptionMessage else len))
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.exceptionMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and (\<lambda>s. True)\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.exceptionMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.exceptionMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)) < 2 ^ word_bits
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x) (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv') (SKIP # hs) (return x) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3011 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage) \<lbrace>?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))) i_' (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3011 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>n. \<lbrakk>len \<le> 3; Suc (Suc (Suc 0)) \<le> len\<rbrakk> \<Longrightarrow> (n < word_of_nat len) = (n < 3)
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.exceptionMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and (\<lambda>s. True)\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.exceptionMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.exceptionMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)) < 2 ^ word_bits
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x) (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv') (SKIP # hs) (return x) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3011 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage) \<lbrace>?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))) i_' (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3011 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 10. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<forall>sa. i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage))) \<longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.exceptionMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and (\<lambda>s. True)\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.exceptionMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.exceptionMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)) < 2 ^ word_bits
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x) (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv') (SKIP # hs) (return x) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3011 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage) \<lbrace>?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))) i_' (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3011 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>rv sa. \<lbrakk>len \<le> unat n_exceptionMessage; i_' sa < word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.exceptionMessage) len))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {sa} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>v :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr s,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,from_bool rv);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long) \<lbrace>\<acute>i = \<^bsup>sa\<^esup>i\<rbrace>
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.exceptionMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and (\<lambda>s. True)\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.exceptionMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.exceptionMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)) < 2 ^ word_bits
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x) (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv') (SKIP # hs) (return x) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3011 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage) \<lbrace>?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))) i_' (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3011 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>t_hrs i. \<lbrakk>len \<le> unat n_exceptionMessage; i < word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.exceptionMessage) len))\<rbrakk> \<Longrightarrow> i < 0xC \<longrightarrow> i < 4 \<longrightarrow> kernel_all_global_addresses.msgRegisters.[unat i] < SCAST(32 signed \<rightarrow> 32) 0x14 \<longrightarrow> hrs_htd t_hrs \<Turnstile>\<^sub>t tcb_ptr_to_ctcb_ptr s \<longrightarrow> (kernel_all_global_addresses.fault_messages.[Suc 0].[unat i] = SCAST(32 signed \<rightarrow> 32) Kernel_C.CPSR \<longrightarrow> 0 \<le>s 8 \<longrightarrow> unat 1 * 2 ^ unat 8 < 2 ^ 31 \<and> 0 \<le>s 1 \<longrightarrow> 0 \<le>s 6 \<longrightarrow> unat 1 * 2 ^ unat 6 < 2 ^ 31 \<longrightarrow> SCAST(32 signed \<rightarrow> 32) Kernel_C.CPSR < SCAST(32 signed \<rightarrow> 32) 0x14 \<longrightarrow> hrs_htd t_hrs \<Turnstile>\<^sub>t tcb_ptr_to_ctcb_ptr r \<longrightarrow> i = i) \<and> (kernel_all_global_addresses.fault_messages.[Suc 0].[unat i] \<noteq> SCAST(32 signed \<rightarrow> 32) Kernel_C.CPSR \<longrightarrow> kernel_all_global_addresses.fault_messages.[Suc 0].[unat i] < SCAST(32 signed \<rightarrow> 32) 0x14 \<longrightarrow> hrs_htd t_hrs \<Turnstile>\<^sub>t tcb_ptr_to_ctcb_ptr r \<longrightarrow> i = i)
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.exceptionMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and (\<lambda>s. True)\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.exceptionMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.exceptionMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)) < 2 ^ word_bits
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x) (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv') (SKIP # hs) (return x) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3011 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage) \<lbrace>?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))) i_' (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3011 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 9. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo n. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; Suc n < length TCB_H.msgRegisters \<and> Suc n < length (take len FaultHandler_H.exceptionMessage)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>_. True) and (\<lambda>s. True)\<rbrace> do v <- asUser s (getRegister (TCB_H.msgRegisters ! n));
asUser r (setRegister (take len FaultHandler_H.exceptionMessage ! n) (local.sanitiseRegister rv (take len FaultHandler_H.exceptionMessage ! n) v))
od \<lbrace>\<lambda>_. (\<lambda>_. True) and (\<lambda>s. True)\<rbrace>
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)) < 2 ^ word_bits
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x) (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv') (SKIP # hs) (return x) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3011 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage) \<lbrace>?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))) i_' (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3011 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 8. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)) < 2 ^ word_bits
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x) (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv') (SKIP # hs) (return x) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3011 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage) \<lbrace>?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))) i_' (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3011 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> min (length TCB_H.msgRegisters) (min (length FaultHandler_H.exceptionMessage) len) < 2 ^ word_bits
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x) (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv') (SKIP # hs) (return x) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3011 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage) \<lbrace>?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))) i_' (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3011 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. len \<le> unat n_exceptionMessage \<Longrightarrow> min (length TCB_H.msgRegisters) (min (Suc (Suc (Suc 0))) len) < 4294967296
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x) (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv') (SKIP # hs) (return x) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3011 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage) \<lbrace>?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))) i_' (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3011 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 7. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv' t t'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF \<acute>i < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x) (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv') (SKIP # hs) (return x) (?d'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv')
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3011 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage) \<lbrace>?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))) i_' (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3011 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 6. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x) (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo x rv') (SKIP # hs) (return x) (IF rv' < word_of_nat len THEN
  \<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI
FI)
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3011 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage) \<lbrace>?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))) i_' (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3011 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> 3; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3005 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?Q'3005 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat len)) (SKIP # hs) (return ()) (Cond {} (\<acute>sendBuf :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) false,tcb_ptr_to_ctcb_ptr s);;
IF \<acute>sendBuf \<noteq> NULL THEN
  While \<lbrace>\<acute>i < word_of_nat len\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (\<acute>r :== kernel_all_global_addresses.fault_messages.[Suc 0].[unat \<acute>i]);;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>v :== h_val (hrs_mem \<acute>t_hrs) (\<acute>sendBuf +\<^sub>p uint (\<acute>i + 1)))));;
\<acute>ret__unsigned_long :== CALL sanitiseRegister_'proc(\<acute>r,archInfo);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr r,\<acute>r,\<acute>ret__unsigned_long);;
\<acute>i :== \<acute>i + 1)
FI) SKIP)
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3011 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage) \<lbrace>?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))) i_' (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3011 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo rv'. \<lbrakk>len \<le> 3; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo; rv' = word_of_nat len\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q3005 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo ()) (?Q'3005 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv archInfo () (word_of_nat len)) (SKIP # hs) (return ()) SKIP
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3011 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage) \<lbrace>?Q3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))) i_' (?Q'3005 length___unsigned_long id___anonymous_enum receiver sender rv archInfo)
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3011 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 5. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> \<lbrace>?R3011 (word_of_nat len) 1 (tcb_ptr_to_ctcb_ptr r) (tcb_ptr_to_ctcb_ptr s) rv\<rbrace> zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister rv rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage) \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))) i_' (\<lambda>a b. UNIV)
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and ?R3011 length___unsigned_long id___anonymous_enum receiver sender a\<rbrace>
 4. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender rv archInfo. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = 1; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; from_bool rv = archInfo\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (length (take len FaultHandler_H.exceptionMessage)))) i_' (\<lambda>a b. UNIV)
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and (\<lambda>a. True)\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. len \<le> unat n_exceptionMessage \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (min (length FaultHandler_H.exceptionMessage) len))) i_' (\<lambda>a b. UNIV)
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and (\<lambda>a. True)\<rbrace>
 3. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>length___unsigned_long id___anonymous_enum receiver sender. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s\<rbrakk> \<Longrightarrow> \<lbrace>?R1931 length___unsigned_long id___anonymous_enum receiver sender\<rbrace> local.getSanitiseRegisterInfo r \<lbrace>\<lambda>a. (\<lambda>a. True) and (\<lambda>a. True) and (\<lambda>a. True)\<rbrace>
 2. \<And>length___unsigned_long id___anonymous_enum receiver sender sa s'. \<lbrakk>len \<le> unat n_exceptionMessage; length___unsigned_long = word_of_nat len; id___anonymous_enum = MessageID_Exception; receiver = tcb_ptr_to_ctcb_ptr r; sender = tcb_ptr_to_ctcb_ptr s; (sa, s') \<in> rf_sr; (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and (\<lambda>y. r \<noteq> s)) sa; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1931 length___unsigned_long id___anonymous_enum receiver sender) sa \<and> s' \<in> {s. thread_'_update (\<lambda>_. receiver) s \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr r\<rbrace>} \<inter> {s'. \<forall>t rv. ((=) \<circ> from_bool) rv (ret__unsigned_long_' t) \<longrightarrow> archInfo_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> UNIV} proof (prove)
goal:
No subgoals! proof (state)
this:
ccorres dc xfdc (valid_pspace' and tcb_at' s and tcb_at' r and obj_at' (\<lambda>t. tcbFault t = Some f) r and K (r \<noteq> s) and K (len \<le> unat n_exceptionMessage)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr s\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr r\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Exception\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = word_of_nat len\<rbrace>) hs (do t <- local.getSanitiseRegisterInfo r;
zipWithM_x (\<lambda>rs rd. do v <- asUser s (getRegister rs);
asUser r (setRegister rd (local.sanitiseRegister t rd v))
od) TCB_H.msgRegisters (take len FaultHandler_H.exceptionMessage)
od) (Call copyMRsFaultReply_'proc)

goal:
No subgoals!