theory Tcb_C

lemma invokeTCB_ReadRegisters_ccorres:
notes
  nat_min_simps [simp del]
  wordSize_def' [simp]
shows
  "ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_')
       (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Restart)
              and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s)
              and (\<lambda>_. target \<noteq> thread))
       (UNIV
            \<inter> {s. tcb_src_' s = tcb_ptr_to_ctcb_ptr target}
            \<inter> {s. suspendSource_' s = from_bool susp}
            \<inter> {s. n_' s = n}
            \<inter> {s. call_' s = from_bool isCall}) []
       (doE reply \<leftarrow> invokeTCB (ReadRegisters target susp n archCp);
           liftE (replyOnRestart thread reply isCall) odE)
       (Call invokeTCB_ReadRegisters_'proc)" supply option.case_cong_weak[cong] empty_fail_cond[simp] apply (rule ccorres_gen_asm) apply (cinit' lift: tcb_src_' suspendSource_' n_' call_'
                simp: invokeTCB_def liftE_bindE bind_assoc) apply (rule ccorres_symb_exec_r) apply (rule_tac xf'=thread_' in ccorres_abstract, ceqv) apply (rename_tac cthread,
            rule_tac P="cthread = tcb_ptr_to_ctcb_ptr thread" in ccorres_gen_asm2) apply (rule ccorres_split_nothrow_dc) apply (simp add: when_def del: Collect_const split del: if_split) apply (rule ccorres_cond2[where R=\<top>], simp add: from_bool_0 Collect_const_mem) apply (ctac add: suspend_ccorres[OF cteDeleteOne_ccorres]) apply (rule ccorres_return_Skip) apply (rule ccorres_pre_getCurThread) apply (simp only: liftE_bindE[symmetric]) apply (ctac add: Arch_performTransfer_ccorres) apply (simp add: liftE_bindE Collect_False
                      del: Collect_const) apply (simp add: replyOnRestart_def liftE_def bind_assoc when_def
                           replyFromKernel_def if_to_top_of_bind setMRs_def
                           zipWithM_x_mapM_x asUser_mapM_x split_def
                      del: Collect_const cong: if_cong) apply (rule ccorres_symb_exec_l) apply (rule ccorres_symb_exec_l[OF _ _ _ empty_fail_getThreadState]) apply (rule ccorres_if_lhs[OF _ ccorres_False[where P'=UNIV]]) apply (rule ccorres_if_lhs) apply (simp add: Collect_True whileAnno_def del: Collect_const) apply (rule ccorres_rhs_assoc)+ apply csymbr apply (ctac add: lookupIPCBuffer_ccorres) apply (rename_tac state destIPCBuffer ipcBuffer) apply (ctac add: setRegister_ccorres) apply (rule ccorres_stateAssert) apply (rule ccorres_rhs_assoc2) apply (rule_tac P="length reply
                               = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)"
                                in ccorres_gen_asm) apply (rule ccorres_split_nothrow_novcg) apply (rule_tac F="\<lambda>m s. obj_at' (\<lambda>tcb. map ((atcbContextGet o tcbArch) tcb) (genericTake n
                                                     (ARM_H.frameRegisters @ ARM_H.gpRegisters))
                                                              = reply) target s"
                                   in ccorres_mapM_x_while) apply clarsimp apply (rule ccorres_guard_imp2) apply (rule ccorres_add_return,
                                    ctac add: getRegister_ccorres_defer
                                                [where thread=target]) apply (ctac add: setRegister_ccorres) apply wp apply simp apply (vcg exspec=getRegister_modifies) apply (clarsimp simp: getRegister_def submonad_asUser.guarded_gets) apply (clarsimp simp: simpler_gets_def obj_at'_weakenE[OF _ TrueI]
                                                  msg_registers_convs) apply (cut_tac x=na in unat_of_nat32) apply (simp add: word_bits_def n_msgRegisters_def) apply (simp add: msg_registers_convs n_msgRegisters_def
                                             word_of_nat_less) apply (subgoal_tac "na < unat n_frameRegisters") apply (intro conjI[rotated] allI impI) apply (assumption | erule sym) apply (rule frame_gp_registers_convs) apply (simp add: frame_gp_registers_convs) apply (drule obj_at_ko_at') apply (clarsimp simp: obj_at'_def projectKOs asUser_fetch_def
                                                   frame_gp_registers_convs genericTake_def
                                                   nth_append
                                            split: if_split) apply (simp add: n_frameRegisters_def n_msgRegisters_def) apply (simp add: frame_gp_registers_convs msg_registers_convs
                                            n_msgRegisters_def n_frameRegisters_def
                                            n_gpRegisters_def msgMaxLength_def msgLengthBits_def
                                     split: option.split) apply (simp add: min_def word_less_nat_alt split: if_split)[1] apply arith apply (rule allI, rule conseqPre, vcg exspec=setRegister_modifies
                                                                exspec=getRegister_modifies) apply clarsimp apply (wp asUser_obj_at') apply simp apply (simp add: word_bits_def msgMaxLength_def
                                         msg_registers_convs n_msgRegisters_def) apply ceqv 
                      (* got to split reply into frameregisters part and gpregisters
                         part remaining, match against 2nd and 4th loop. 3rd loop
                         never executes with current configuration *)
                       apply (simp add: msg_registers_convs del: Collect_const) apply (rule iffD2 [OF ccorres_abstract_cong]) apply (rule bind_apply_cong[OF _ refl]) apply (rule_tac n1="min (unat n_frameRegisters - unat n_msgRegisters) (unat n)"
                                   in fun_cong [OF mapM_x_split_append]) apply (rule_tac P="destIPCBuffer \<noteq> Some 0" in ccorres_gen_asm) apply (subgoal_tac "(ipcBuffer = NULL) = (destIPCBuffer = None)") prefer 2 apply (clarsimp simp: option_to_ptr_def option_to_0_def
                                      split: option.split_asm) apply (simp add: bind_assoc del: Collect_const) apply (rule_tac xf'=i_' and r'="\<lambda>_ rv. unat rv = min (unat n_frameRegisters)
                                                                      (min (unat n)
                                                                           (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters
                                                                              | _ \<Rightarrow> unat n_frameRegisters))"
                                 in ccorres_split_nothrow_novcg) apply (rule ccorres_Cond_rhs) apply (rule ccorres_rel_imp,
                                  rule_tac F="\<lambda>m s. obj_at' (\<lambda>tcb. map ((atcbContextGet o tcbArch) tcb) (genericTake n
                                                      (ARM_H.frameRegisters @ ARM_H.gpRegisters))
                                                               = reply) target s
                                                 \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s
                                                 \<and> valid_pspace' s"
                                       and i="unat n_msgRegisters"
                                    in ccorres_mapM_x_while') apply (intro allI impI, elim conjE exE, hypsubst, simp) apply (simp add: less_diff_conv) apply (rule ccorres_guard_imp2) apply (rule ccorres_add_return,
                                        ctac add: getRegister_ccorres_defer[where thread=target]) apply (rule ccorres_move_array_assertion_ipc_buffer
                                            | (rule ccorres_flip_Guard,
                                                rule ccorres_move_array_assertion_ipc_buffer))+ apply (rule storeWordUser_ccorres) apply wp apply (vcg exspec=getRegister_modifies) apply (clarsimp simp: obj_at'_weakenE[OF _ TrueI]
                                                      word_size unat_gt_0 option_to_ptr_def
                                                      option_to_0_def) apply (intro conjI[rotated] impI allI) apply (simp add: n_msgRegisters_def n_frameRegisters_def
                                                        word_less_nat_alt) apply (subst unat_add_lem[THEN iffD1], simp_all add: unat_of_nat)[1] prefer 3 apply (erule sym) apply (simp add: n_msgRegisters_def msg_registers_convs
                                                      msg_align_bits msgMaxLength_def) apply (simp(no_asm) add: unat_arith_simps unat_of_nat
                                                        cong: if_cong, simp) apply (simp add: n_msgRegisters_def msg_registers_convs
                                                     msg_align_bits msgMaxLength_def) apply (simp(no_asm) add: unat_arith_simps unat_of_nat
                                                       cong: if_cong, simp) apply (simp add: option_to_ptr_def option_to_0_def
                                                    msg_registers_convs upto_enum_word wordSize_def'
                                              del: upt.simps) apply (rule frame_gp_registers_convs) apply (simp add: frame_gp_registers_convs less_diff_conv) apply (subst iffD1 [OF unat_add_lem]) apply (simp add: n_msgRegisters_def n_frameRegisters_def
                                                    word_le_nat_alt unat_of_nat) apply (simp add: n_frameRegisters_def n_msgRegisters_def
                                                   unat_of_nat) apply (clarsimp simp: valid_ipc_buffer_ptr'_def) apply (erule aligned_add_aligned) apply (rule is_aligned_mult_triv2[where n=2, simplified]) apply (simp add: msg_align_bits) apply (clarsimp simp: getRegister_def submonad_asUser.guarded_gets
                                                      obj_at'_weakenE[OF _ TrueI]) apply (clarsimp simp: asUser_fetch_def simpler_gets_def
                                                      obj_at'_def projectKOs genericTake_def
                                                      nth_append frame_gp_registers_convs) apply (simp add: n_msgRegisters_def unat_of_nat n_frameRegisters_def) apply (subst iffD1 [OF unat_add_lem]) apply (simp add: unat_of_nat)+ apply (clarsimp simp: less_diff_conv) apply (simp add: frame_gp_registers_convs msg_registers_convs
                                                n_msgRegisters_def n_frameRegisters_def
                                                n_gpRegisters_def Types_H.msgMaxLength_def
                                                Types_H.msgLengthBits_def
                                         split: option.split) apply (simp add: min_def word_less_nat_alt split: if_split)[1] apply (simp split: if_split_asm, arith+)[1] apply (rule allI, rule conseqPre, vcg) apply clarsimp apply (wp) apply (clarsimp simp: less_diff_conv) apply (simp add: word_bits_def n_msgRegisters_def n_frameRegisters_def
                                             Types_H.msgLengthBits_def Types_H.msgMaxLength_def
                                             msg_registers_convs) apply (clarsimp simp: n_msgRegisters_def n_frameRegisters_def
                                                 msgMaxLength_def Types_H.msgLengthBits_def
                                                 n_gpRegisters_def msg_registers_convs
                                          split: option.split_asm) apply (simp add: min_def split: if_split_asm if_split) apply arith apply (drule_tac s=rv'a in sym, simp) apply (rule_tac P=\<top> and P'="{s. i_' s = rv'a}" in ccorres_inst) apply clarsimp apply (elim disjE impCE) apply (clarsimp simp: word_le_nat_alt linorder_not_less) apply (subst (asm) unat_of_nat32) apply (simp add: n_msgRegisters_def word_bits_def) apply (clarsimp simp: mapM_x_Nil) apply (rule ccorres_guard_imp2, rule ccorres_return_Skip') apply (simp add: n_msgRegisters_def n_frameRegisters_def
                                             n_gpRegisters_def cong: option.case_cong) apply (simp add: min_def split: if_split option.split) apply (simp add: mapM_x_Nil) apply (rule ccorres_guard_imp2, rule ccorres_return_Skip') apply (simp add: n_msgRegisters_def n_frameRegisters_def
                                            n_gpRegisters_def cong: option.case_cong) apply (simp add: min_def split: if_split option.split) apply (clarsimp simp only: unat_arith_simps, simp) apply (clarsimp simp: less_diff_conv word_le_nat_alt linorder_not_less) apply (subst(asm) unat_of_nat32) apply (simp add: word_bits_def n_msgRegisters_def) apply (simp add: mapM_x_Nil n_frameRegisters_def n_gpRegisters_def) apply (rule ccorres_guard_imp2, rule ccorres_return_Skip') apply (simp add: n_msgRegisters_def n_frameRegisters_def
                                           n_gpRegisters_def cong: option.case_cong) apply ceqv apply csymbr apply csymbr apply (rule iffD1[OF ccorres_expand_while_iff_Seq]) apply (rule ccorres_cond_false) apply (rule ccorres_split_nothrow_novcg) apply (rule_tac xf'=i_' in ccorres_abstract, ceqv) apply (rename_tac i_c, rule_tac P="i_c = 0" in ccorres_gen_asm2) apply (simp add: drop_zip del: Collect_const) apply (rule ccorres_Cond_rhs) apply (rule_tac F="\<lambda>m s. obj_at' (\<lambda>tcb. map ((atcbContextGet o tcbArch) tcb) (genericTake n
                                                       (ARM_H.frameRegisters @ ARM_H.gpRegisters))
                                                                = reply) target s
                                                  \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s"
                                        and i="0" in ccorres_mapM_x_while') apply (clarsimp simp: less_diff_conv drop_zip) apply (rule ccorres_guard_imp2) apply (rule ccorres_add_return,
                                         ctac add: getRegister_ccorres_defer[where thread=target]) apply (rule ccorres_move_array_assertion_ipc_buffer
                                             | (rule ccorres_flip_Guard,
                                                 rule ccorres_move_array_assertion_ipc_buffer))+ apply (rule storeWordUser_ccorres) apply wp apply (vcg exspec=getRegister_modifies) apply (clarsimp simp: obj_at'_weakenE[OF _ TrueI]
                                                       word_size unat_gt_0 option_to_ptr_def
                                                       option_to_0_def) apply (intro conjI[rotated] impI allI) apply (simp add: n_frameRegisters_def n_msgRegisters_def
                                                         length_msgRegisters word_of_nat_less
                                                         n_gpRegisters_def) prefer 3 apply (erule sym) apply (simp add: n_frameRegisters_def n_msgRegisters_def msg_registers_convs
                                                       msg_align_bits msgMaxLength_def) apply (simp(no_asm) add: unat_arith_simps unat_of_nat
                                                         cong: if_cong, simp) apply (simp add: n_frameRegisters_def n_msgRegisters_def msg_registers_convs
                                                      msg_align_bits msgMaxLength_def) apply (simp(no_asm) add: unat_arith_simps unat_of_nat
                                                        cong: if_cong, simp) apply (simp add: option_to_ptr_def option_to_0_def
                                                     msg_registers_convs upto_enum_word
                                                     n_msgRegisters_def n_frameRegisters_def
                                                     n_gpRegisters_def msgMaxLength_def msgLengthBits_def
                                                del: upt.simps upt_rec_numeral) apply (rule frame_gp_registers_convs) apply (simp add: frame_gp_registers_convs n_msgRegisters_def n_frameRegisters_def
                                                    n_gpRegisters_def msgMaxLength_def msgLengthBits_def
                                                    unat_of_nat) apply (clarsimp simp: valid_ipc_buffer_ptr'_def,
                                         erule aligned_add_aligned) apply (rule is_aligned_mult_triv2[where n=2, simplified]) apply (simp add: msg_align_bits) apply (clarsimp simp: getRegister_def submonad_asUser.guarded_gets
                                                       obj_at'_weakenE[OF _ TrueI]) apply (clarsimp simp: asUser_fetch_def simpler_gets_def
                                                       obj_at'_def projectKOs genericTake_def
                                                       nth_append frame_gp_registers_convs
                                                       n_frameRegisters_def n_gpRegisters_def
                                                       n_msgRegisters_def frame_gp_registers_convs
                                                 cong: if_cong split: if_split) apply (clarsimp simp: frame_gp_registers_convs n_gpRegisters_def
                                                       min.absorb1 unat_of_nat) apply (clarsimp simp: less_diff_conv) apply (clarsimp simp: nth_append frame_gp_registers_convs
                                                      n_frameRegisters_def n_gpRegisters_def
                                                      n_msgRegisters_def frame_gp_registers_convs
                                                      Types_H.msgMaxLength_def Types_H.msgLengthBits_def
                                                      msg_registers_convs
                                                cong: if_cong split: if_split) apply (simp add: word_less_nat_alt unat_of_nat) apply (simp add: iffD1[OF unat_add_lem] cong: conj_cong) apply (simp add: min_def
                                          split: if_split if_split_asm, arith+)[1] apply (rule allI, rule conseqPre, vcg) apply clarsimp apply wp apply (simp add: word_bits_def n_frameRegisters_def n_gpRegisters_def
                                              n_msgRegisters_def) apply (simp add: min_less_iff_disj less_imp_diff_less) apply (simp add: drop_zip n_gpRegisters_def) apply (elim disjE impCE) apply (clarsimp simp: mapM_x_Nil cong: ccorres_all_cong) apply (rule ccorres_return_Skip') apply (simp add: linorder_not_less word_le_nat_alt drop_zip
                                             mapM_x_Nil n_frameRegisters_def n_msgRegisters_def
                                       cong: ccorres_all_cong) apply (rule ccorres_guard_imp2, rule ccorres_return_Skip') apply simp apply ceqv apply csymbr apply (rule ccorres_rhs_assoc2) apply (ctac (no_vcg) add: setMessageInfo_ccorres) apply (ctac (no_vcg)) apply (rule_tac P=\<top> and P'=UNIV in ccorres_from_vcg_throws) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def) apply (wp | simp add: valid_tcb_state'_def)+ apply (clarsimp simp: ThreadState_Running_def mask_def) apply (rule mapM_x_wp') apply (rule hoare_pre) apply (wp sch_act_wf_lift valid_queues_lift tcb_in_cur_domain'_lift) apply clarsimp apply (clarsimp simp: guard_is_UNIV_def Collect_const_mem) apply (simp add: message_info_to_H_def) apply (clarsimp simp: n_frameRegisters_def n_msgRegisters_def
                                              n_gpRegisters_def field_simps upto_enum_word
                                              word_less_nat_alt Types_H.msgMaxLength_def
                                              Types_H.msgLengthBits_def
                                    simp del: upt.simps
                                       split: option.split_asm) apply (clarsimp simp: min_def iffD2 [OF mask_eq_iff_w2p] word_size
                                               word_less_nat_alt
                                       split: if_split_asm dest!: word_unat.Rep_inverse') apply (clarsimp simp: length_msgRegisters n_msgRegisters_def) apply (clarsimp simp: min_def iffD2 [OF mask_eq_iff_w2p] word_size
                                              word_less_nat_alt
                                      split: if_split_asm dest!: word_unat.Rep_inverse') apply (simp add: pred_conj_def) apply (wp mapM_x_wp' sch_act_wf_lift valid_queues_lift hoare_weak_lift_imp
                                 tcb_in_cur_domain'_lift) apply (simp add: n_frameRegisters_def n_msgRegisters_def
                                       guard_is_UNIV_def) apply simp apply (rule mapM_x_wp') apply (rule hoare_pre) apply (wp asUser_obj_at'[where t'=target] hoare_weak_lift_imp
                                asUser_valid_ipc_buffer_ptr') apply clarsimp apply (clarsimp simp: guard_is_UNIV_def Collect_const_mem
                                          msg_registers_convs n_msgRegisters_def
                                          n_frameRegisters_def n_gpRegisters_def
                                          msgMaxLength_def msgLengthBits_def
                                          word_less_nat_alt unat_of_nat) apply (wp (once) hoare_drop_imps) apply (wp asUser_obj_at'[where t'=target] hoare_weak_lift_imp
                             asUser_valid_ipc_buffer_ptr') apply (vcg exspec=setRegister_modifies) apply simp apply (strengthen valid_ipc_buffer_ptr_the_strengthen) apply simp apply (wp lookupIPCBuffer_Some_0 | wp (once) hoare_drop_imps)+ apply (simp add: Collect_const_mem ARM_H.badgeRegister_def
                                 ARM.badgeRegister_def
                                 "StrictC'_register_defs") apply (vcg exspec=lookupIPCBuffer_modifies) apply simp apply (ctac(no_vcg) add: setThreadState_ccorres) apply (rule ccorres_from_vcg_throws[where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (simp add: return_def) apply wp+ apply (simp cong: rev_conj_cong) apply wp apply (wp asUser_inv mapM_wp' getRegister_inv
                      asUser_get_registers[simplified] hoare_weak_lift_imp)+ apply (rule hoare_strengthen_post, rule asUser_get_registers) apply (clarsimp simp: obj_at'_def genericTake_def
                                  frame_gp_registers_convs) apply arith apply (wp hoare_weak_lift_imp) apply simp apply (rule ccorres_inst[where P=\<top> and P'=UNIV], simp) apply (simp add: performTransfer_def) apply wp apply (simp add: Collect_const_mem "StrictC'_thread_state_defs"
                        mask_def) apply vcg apply (rule_tac Q="\<lambda>rv. invs' and st_tcb_at' ((=) Restart) thread
                             and tcb_at' target" in hoare_post_imp) apply (clarsimp simp: pred_tcb_at') apply (auto elim!: pred_tcb'_weakenE)[1] apply (wp suspend_st_tcb_at') apply (vcg exspec=suspend_modifies) apply vcg apply (rule conseqPre, vcg, clarsimp) apply (clarsimp simp: rf_sr_ksCurThread ct_in_state'_def
                 split: if_split) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s) and (\<lambda>_. target \<noteq> thread)) (UNIV \<inter> \<lbrace>\<acute>tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrace> \<inter> \<lbrace>\<acute>suspendSource = from_bool susp\<rbrace> \<inter> \<lbrace>\<acute>n = n\<rbrace> \<inter> \<lbrace>\<acute>call = from_bool isCall\<rbrace>) [] (doE reply <- invokeTCB (tcbinvocation.ReadRegisters target susp n archCp);
liftE (replyOnRestart thread reply isCall)
odE) (Call invokeTCB_ReadRegisters_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s) and (\<lambda>_. target \<noteq> thread)) (UNIV \<inter> \<lbrace>\<acute>tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrace> \<inter> \<lbrace>\<acute>suspendSource = from_bool susp\<rbrace> \<inter> \<lbrace>\<acute>n = n\<rbrace> \<inter> \<lbrace>\<acute>call = from_bool isCall\<rbrace>) [] (doE reply <- invokeTCB (tcbinvocation.ReadRegisters target susp n archCp);
liftE (replyOnRestart thread reply isCall)
odE) (Call invokeTCB_ReadRegisters_'proc) proof (prove)
goal (1 subgoal):
 1. target \<noteq> thread \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s)) (UNIV \<inter> \<lbrace>\<acute>tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrace> \<inter> \<lbrace>\<acute>suspendSource = from_bool susp\<rbrace> \<inter> \<lbrace>\<acute>n = n\<rbrace> \<inter> \<lbrace>\<acute>call = from_bool isCall\<rbrace>) [] (doE reply <- invokeTCB (tcbinvocation.ReadRegisters target susp n archCp);
liftE (replyOnRestart thread reply isCall)
odE) (Call invokeTCB_ReadRegisters_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3967 calla na suspendSource tcb_src) (?Q'3967 calla na suspendSource tcb_src) [SKIP] (do y <- when susp (ThreadDecls_H.suspend target);
self <- getCurThread;
y <- performTransfer archCp target self;
reply <- asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)));
liftE (replyOnRestart thread reply isCall)
od) (\<acute>thread :== \<acute>ksCurThread;;
(IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI;;
(\<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_src,\<acute>ksCurThread);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(IF calla \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,\<acute>thread);;
CALL setRegister_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < na \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(\<acute>thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < na \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < na \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(\<acute>thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>calla na suspendSource tcb_src s s'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q3967 calla na suspendSource tcb_src s \<and> s' \<in> ?Q'3967 calla na suspendSource tcb_src proof (prove)
goal (4 subgoals):
 1. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3967 calla na suspendSource tcb_src) (?Q'3973 calla na suspendSource tcb_src) [SKIP] (do y <- when susp (ThreadDecls_H.suspend target);
self <- getCurThread;
y <- performTransfer archCp target self;
reply <- asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)));
liftE (replyOnRestart thread reply isCall)
od) (IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI;;
(\<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_src,\<acute>ksCurThread);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(IF calla \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,\<acute>thread);;
CALL setRegister_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < na \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(\<acute>thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < na \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < na \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(\<acute>thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread (?Q'3973 calla na suspendSource tcb_src)
 3. \<And>calla na suspendSource tcb_src s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; ?Q3967 calla na suspendSource tcb_src s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== \<acute>ksCurThread {s'. (s, s') \<in> rf_sr}
 4. \<And>calla na suspendSource tcb_src s s'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q3967 calla na suspendSource tcb_src s \<and> s' \<in> ?Q'3967 calla na suspendSource tcb_src proof (prove)
goal (4 subgoals):
 1. \<And>calla na suspendSource tcb_src rv'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3967 calla na suspendSource tcb_src) (?G'3977 calla na suspendSource tcb_src rv') [SKIP] (do y <- when susp (ThreadDecls_H.suspend target);
self <- getCurThread;
y <- performTransfer archCp target self;
reply <- asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)));
liftE (replyOnRestart thread reply isCall)
od) (IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI;;
(\<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_src,\<acute>ksCurThread);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(IF calla \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,rv');;
CALL setRegister_'proc(rv',SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < na \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(rv',kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < na \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < na \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(rv',kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(rv',SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(rv',SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> ?G'3977 calla na suspendSource tcb_src (thread_' s)}
 3. \<And>calla na suspendSource tcb_src s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; ?Q3967 calla na suspendSource tcb_src s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== \<acute>ksCurThread {s'. (s, s') \<in> rf_sr}
 4. \<And>calla na suspendSource tcb_src s s'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q3967 calla na suspendSource tcb_src s \<and> s' \<in> ?Q'3967 calla na suspendSource tcb_src proof (prove)
goal (4 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3967 calla na suspendSource tcb_src) (?G'4647 calla na suspendSource tcb_src cthread) [SKIP] (do y <- when susp (ThreadDecls_H.suspend target);
self <- getCurThread;
y <- performTransfer archCp target self;
reply <- asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)));
liftE (replyOnRestart thread reply isCall)
od) (IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI;;
(\<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_src,\<acute>ksCurThread);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(IF calla \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,cthread);;
CALL setRegister_'proc(cthread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < na \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(cthread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < na \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < na \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(cthread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(cthread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(cthread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> ?G'4647 calla na suspendSource tcb_src (thread_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 3. \<And>calla na suspendSource tcb_src s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; ?Q3967 calla na suspendSource tcb_src s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== \<acute>ksCurThread {s'. (s, s') \<in> rf_sr}
 4. \<And>calla na suspendSource tcb_src s s'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q3967 calla na suspendSource tcb_src s \<and> s' \<in> ?Q'3967 calla na suspendSource tcb_src proof (prove)
goal (7 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P4649 calla na suspendSource tcb_src) (?P'4648 calla na suspendSource tcb_src cthread) [SKIP] (when susp (ThreadDecls_H.suspend target)) (IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI)
 2. \<And>calla na suspendSource tcb_src cthread y rv'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4648 calla na suspendSource tcb_src cthread y) (?Q'4648 calla na suspendSource tcb_src cthread y rv') [SKIP] (do self <- getCurThread;
y <- performTransfer archCp target self;
reply <- asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)));
liftE (replyOnRestart thread reply isCall)
od) (\<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_src,\<acute>ksCurThread);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(IF calla \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,cthread);;
CALL setRegister_'proc(cthread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < na \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(cthread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < na \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < na \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(cthread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(cthread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(cthread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>?Q4648 calla na suspendSource tcb_src cthread\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4648 calla na suspendSource tcb_src cthread\<^esub> (?R'4648 calla na suspendSource tcb_src cthread) IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'4648 calla na suspendSource tcb_src cthread y (xfdc s)}
 5. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> ?P'4648 calla na suspendSource tcb_src (thread_' s) \<inter> ?R'4648 calla na suspendSource tcb_src (thread_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 6. \<And>calla na suspendSource tcb_src s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; (?P4649 calla na suspendSource tcb_src and ?R4650 calla na suspendSource tcb_src) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== \<acute>ksCurThread {s'. (s, s') \<in> rf_sr}
 7. \<And>calla na suspendSource tcb_src s s'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P4649 calla na suspendSource tcb_src and ?R4650 calla na suspendSource tcb_src) s \<and> s' \<in> ?Q'3967 calla na suspendSource tcb_src proof (prove)
goal (7 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P4649 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target)) (?P'4648 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread)) [SKIP] (if susp then ThreadDecls_H.suspend target else return ()) (IF susp THEN
  CALL suspend_'proc(tcb_ptr_to_ctcb_ptr target)
FI)
 2. \<And>calla na suspendSource tcb_src cthread y rv'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4648 calla na suspendSource tcb_src cthread y) (?Q'4648 calla na suspendSource tcb_src cthread y rv') [SKIP] (do self <- getCurThread;
y <- performTransfer archCp target self;
reply <- asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)));
liftE (replyOnRestart thread reply isCall)
od) (\<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_src,\<acute>ksCurThread);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(IF calla \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,cthread);;
CALL setRegister_'proc(cthread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < na \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(cthread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < na \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < na \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(cthread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(cthread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(cthread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>?Q4648 calla na suspendSource tcb_src cthread\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4648 calla na suspendSource tcb_src cthread\<^esub> (?R'4648 calla na suspendSource tcb_src cthread) IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'4648 calla na suspendSource tcb_src cthread y (xfdc s)}
 5. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> ?P'4648 calla na suspendSource tcb_src (thread_' s) \<inter> ?R'4648 calla na suspendSource tcb_src (thread_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 6. \<And>calla na suspendSource tcb_src s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; (?P4649 calla na suspendSource tcb_src and ?R4650 calla na suspendSource tcb_src) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== \<acute>ksCurThread {s'. (s, s') \<in> rf_sr}
 7. \<And>calla na suspendSource tcb_src s s'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P4649 calla na suspendSource tcb_src and ?R4650 calla na suspendSource tcb_src) s \<and> s' \<in> ?Q'3967 calla na suspendSource tcb_src proof (prove)
goal (8 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pt4667 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target)) (?Rt4663 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread)) [SKIP] (ThreadDecls_H.suspend target) (CALL suspend_'proc(tcb_ptr_to_ctcb_ptr target))
 2. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf4665 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target)) (?Rf4661 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread)) [SKIP] (return ()) SKIP
 3. \<And>calla na suspendSource tcb_src cthread y rv'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4648 calla na suspendSource tcb_src cthread y) (?Q'4648 calla na suspendSource tcb_src cthread y rv') [SKIP] (do self <- getCurThread;
y <- performTransfer archCp target self;
reply <- asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)));
liftE (replyOnRestart thread reply isCall)
od) (\<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_src,\<acute>ksCurThread);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(IF calla \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,cthread);;
CALL setRegister_'proc(cthread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < na \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(cthread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < na \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < na \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(cthread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(cthread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(cthread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 4. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>?Q4648 calla na suspendSource tcb_src cthread\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4648 calla na suspendSource tcb_src cthread\<^esub> (?R'4648 calla na suspendSource tcb_src cthread) IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'4648 calla na suspendSource tcb_src cthread y (xfdc s)}
 6. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> {sa. (sa \<in> \<lbrace>susp\<rbrace> \<longrightarrow> sa \<in> ?Rt4663 calla na suspendSource tcb_src (thread_' s)) \<and> (sa \<notin> \<lbrace>susp\<rbrace> \<longrightarrow> sa \<in> ?Rf4661 calla na suspendSource tcb_src (thread_' s))} \<inter> ?R'4648 calla na suspendSource tcb_src (thread_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 7. \<And>calla na suspendSource tcb_src s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> ?Pt4667 calla na suspendSource tcb_src s) and (\<lambda>s. \<not> susp \<longrightarrow> ?Pf4665 calla na suspendSource tcb_src s) and ?R4650 calla na suspendSource tcb_src) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== \<acute>ksCurThread {s'. (s, s') \<in> rf_sr}
 8. \<And>calla na suspendSource tcb_src s s'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> ?Pt4667 calla na suspendSource tcb_src s) and (\<lambda>s. \<not> susp \<longrightarrow> ?Pf4665 calla na suspendSource tcb_src s) and ?R4650 calla na suspendSource tcb_src) s \<and> s' \<in> ?Q'3967 calla na suspendSource tcb_src proof (prove)
goal (7 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf4665 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target)) (?Rf4661 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread)) [SKIP] (return ()) SKIP
 2. \<And>calla na suspendSource tcb_src cthread y rv'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4648 calla na suspendSource tcb_src cthread y) (?Q'4648 calla na suspendSource tcb_src cthread y rv') [SKIP] (do self <- getCurThread;
y <- performTransfer archCp target self;
reply <- asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)));
liftE (replyOnRestart thread reply isCall)
od) (\<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_src,\<acute>ksCurThread);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(IF calla \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,cthread);;
CALL setRegister_'proc(cthread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < na \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(cthread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < na \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < na \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(cthread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(cthread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(cthread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 3. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>?Q4648 calla na suspendSource tcb_src cthread\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4648 calla na suspendSource tcb_src cthread\<^esub> (?R'4648 calla na suspendSource tcb_src cthread) IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'4648 calla na suspendSource tcb_src cthread y (xfdc s)}
 5. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> {sa. (sa \<in> \<lbrace>susp\<rbrace> \<longrightarrow> sa \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (sa \<notin> \<lbrace>susp\<rbrace> \<longrightarrow> sa \<in> ?Rf4661 calla na suspendSource tcb_src (thread_' s))} \<inter> ?R'4648 calla na suspendSource tcb_src (thread_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 6. \<And>calla na suspendSource tcb_src s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> ?Pf4665 calla na suspendSource tcb_src s) and ?R4650 calla na suspendSource tcb_src) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== \<acute>ksCurThread {s'. (s, s') \<in> rf_sr}
 7. \<And>calla na suspendSource tcb_src s s'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> ?Pf4665 calla na suspendSource tcb_src s) and ?R4650 calla na suspendSource tcb_src) s \<and> s' \<in> ?Q'3967 calla na suspendSource tcb_src proof (prove)
goal (6 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread y rv'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4648 calla na suspendSource tcb_src cthread y) (?Q'4648 calla na suspendSource tcb_src cthread y rv') [SKIP] (do self <- getCurThread;
y <- performTransfer archCp target self;
reply <- asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)));
liftE (replyOnRestart thread reply isCall)
od) (\<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_src,\<acute>ksCurThread);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(IF calla \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,cthread);;
CALL setRegister_'proc(cthread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < na \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(cthread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < na \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < na \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(cthread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(cthread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(cthread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>?Q4648 calla na suspendSource tcb_src cthread\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4648 calla na suspendSource tcb_src cthread\<^esub> (?R'4648 calla na suspendSource tcb_src cthread) IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> ?Q'4648 calla na suspendSource tcb_src cthread y (xfdc s)}
 4. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> {s. (s \<in> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'4648 calla na suspendSource tcb_src (thread_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 5. \<And>calla na suspendSource tcb_src s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== \<acute>ksCurThread {s'. (s, s') \<in> rf_sr}
 6. \<And>calla na suspendSource tcb_src s s'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s \<and> s' \<in> ?Q'3967 calla na suspendSource tcb_src proof (prove)
goal (6 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P4687 calla na suspendSource tcb_src cthread y self) (?P'4686 calla na suspendSource tcb_src cthread y rv' self) [SKIP] (do y <- performTransfer archCp target self;
reply <- asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)));
liftE (replyOnRestart thread reply isCall)
od) (\<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_src,\<acute>ksCurThread);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(IF calla \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,cthread);;
CALL setRegister_'proc(cthread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < na \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(cthread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < na \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < na \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(cthread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_src,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(cthread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(cthread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>\<lambda>y s. \<forall>rv. ksCurThread s = rv \<longrightarrow> ?P4687 calla na suspendSource tcb_src cthread y rv s\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4648 calla na suspendSource tcb_src cthread\<^esub> (?R'4648 calla na suspendSource tcb_src cthread) IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>rv. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> sa \<in> ?P'4686 calla na suspendSource tcb_src cthread y (xfdc s) rv}}
 4. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> {s. (s \<in> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'4648 calla na suspendSource tcb_src (thread_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 5. \<And>calla na suspendSource tcb_src s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== \<acute>ksCurThread {s'. (s, s') \<in> rf_sr}
 6. \<And>calla na suspendSource tcb_src s s'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s \<and> s' \<in> ?Q'3967 calla na suspendSource tcb_src proof (prove)
goal (6 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P4687 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self) (?P'4686 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y rv' self) [SKIP] (doE y <- liftE (performTransfer archCp target self);
reply <- liftE (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))));
liftE (replyOnRestart thread reply isCall)
odE) (\<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread);;
(IF \<acute>e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update e_'
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>\<lambda>y s. \<forall>rv. ksCurThread s = rv \<longrightarrow> ?P4687 calla na suspendSource tcb_src cthread y rv s\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4648 calla na suspendSource tcb_src cthread\<^esub> (?R'4648 calla na suspendSource tcb_src cthread) IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>rv. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> sa \<in> ?P'4686 calla na suspendSource tcb_src cthread y (xfdc s) rv}}
 4. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> {s. (s \<in> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'4648 calla na suspendSource tcb_src (thread_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 5. \<And>calla na suspendSource tcb_src s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== \<acute>ksCurThread {s'. (s, s') \<in> rf_sr}
 6. \<And>calla na suspendSource tcb_src s s'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s \<and> s' \<in> ?Q'3967 calla na suspendSource tcb_src proof (prove)
goal (9 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread y rv' self rv e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; dc rv (K () e); id e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4693 calla na suspendSource tcb_src cthread y rv' self rv) (?Q'4693 calla na suspendSource tcb_src cthread y rv' self rv e) [SKIP] (doE reply <- liftE (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))));
liftE (replyOnRestart thread reply isCall)
odE) (IF e \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. e)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 3. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>?Q4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>, \<lbrace>?QE4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4696 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y rv' self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> ?Q'4693 calla na suspendSource tcb_src cthread y rv' self rv (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''4693 calla na suspendSource tcb_src cthread y rv' self err (e_' s) (errstate s)))}
 5. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>\<lambda>y s. \<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R4703 calla na suspendSource tcb_src cthread y rv) s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4648 calla na suspendSource tcb_src cthread\<^esub> (?R'4648 calla na suspendSource tcb_src cthread) IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>rv. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> sa \<in> {s. tcb_dest_'_update (\<lambda>_. ksCurThread_' (globals s)) (tcb_src_'_update (\<lambda>_. tcb_src) (arch_'_update (\<lambda>_. arch_' s) s)) \<in> UNIV} \<inter> ?R'4696 calla na suspendSource tcb_src cthread y (xfdc s) rv}}
 7. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> {s. (s \<in> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'4648 calla na suspendSource tcb_src (thread_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 8. \<And>calla na suspendSource tcb_src s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== \<acute>ksCurThread {s'. (s, s') \<in> rf_sr}
 9. \<And>calla na suspendSource tcb_src s s'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s \<and> s' \<in> ?Q'3967 calla na suspendSource tcb_src proof (prove)
goal (9 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()) (?Q'4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (do reply <- asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)));
liftE (replyOnRestart thread reply isCall)
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 3. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>?Q4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>, \<lbrace>?QE4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4696 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y rv' self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> ?Q'4693 calla na suspendSource tcb_src cthread y rv' self rv (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''4693 calla na suspendSource tcb_src cthread y rv' self err (e_' s) (errstate s)))}
 5. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>\<lambda>y s. \<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R4703 calla na suspendSource tcb_src cthread y rv) s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4648 calla na suspendSource tcb_src cthread\<^esub> (?R'4648 calla na suspendSource tcb_src cthread) IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>rv. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> sa \<in> {s. tcb_dest_'_update (\<lambda>_. ksCurThread_' (globals s)) (tcb_src_'_update (\<lambda>_. tcb_src) (arch_'_update (\<lambda>_. arch_' s) s)) \<in> UNIV} \<inter> ?R'4696 calla na suspendSource tcb_src cthread y (xfdc s) rv}}
 7. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> {s. (s \<in> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'4648 calla na suspendSource tcb_src (thread_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 8. \<And>calla na suspendSource tcb_src s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== \<acute>ksCurThread {s'. (s, s') \<in> rf_sr}
 9. \<And>calla na suspendSource tcb_src s s'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s \<and> s' \<in> ?Q'3967 calla na suspendSource tcb_src proof (prove)
goal (9 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()) (?Q'4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)) [SKIP] (do reply <- asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)));
state <- getThreadState thread;
if state = Structures_H.thread_state.Restart then if isCall then do destIPCBuffer <- lookupIPCBuffer True thread;
y <- asUser thread (setRegister Notification_H.badgeRegister 0);
y <- stateAssert (tcb_at' thread) [];
y <- mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply));
y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od else do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od else return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 3. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>?Q4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>, \<lbrace>?QE4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4696 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y rv' self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> ?Q'4693 calla na suspendSource tcb_src cthread y rv' self rv (e_' s))) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''4693 calla na suspendSource tcb_src cthread y rv' self err (e_' s) (errstate s)))}
 5. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>\<lambda>y s. \<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R4703 calla na suspendSource tcb_src cthread y rv) s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4648 calla na suspendSource tcb_src cthread\<^esub> (?R'4648 calla na suspendSource tcb_src cthread) IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>rv. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> sa \<in> {s. tcb_dest_'_update (\<lambda>_. ksCurThread_' (globals s)) (tcb_src_'_update (\<lambda>_. tcb_src) (arch_'_update (\<lambda>_. arch_' s) s)) \<in> UNIV} \<inter> ?R'4696 calla na suspendSource tcb_src cthread y (xfdc s) rv}}
 7. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> {s. (s \<in> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'4648 calla na suspendSource tcb_src (thread_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 8. \<And>calla na suspendSource tcb_src s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== \<acute>ksCurThread {s'. (s, s') \<in> rf_sr}
 9. \<And>calla na suspendSource tcb_src s s'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s \<and> s' \<in> ?Q'3967 calla na suspendSource tcb_src proof (prove)
goal (12 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply) (?Q'5346 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply) [SKIP] (do state <- getThreadState thread;
if state = Structures_H.thread_state.Restart then if isCall then do destIPCBuffer <- lookupIPCBuffer True thread;
y <- asUser thread (setRegister Notification_H.badgeRegister 0);
y <- stateAssert (tcb_at' thread) [];
y <- mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply));
y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od else do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od else return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
 5. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 6. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>?Q4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>, \<lbrace>?QE4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4696 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y rv' self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> {s'. \<forall>rva sa. (sa, s') \<in> rf_sr \<and> ?Q5348 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva sa \<longrightarrow> s' \<in> ?Q'5346 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva})) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''4693 calla na suspendSource tcb_src cthread y rv' self err (e_' s) (errstate s)))}
 8. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>\<lambda>y s. \<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R4703 calla na suspendSource tcb_src cthread y rv) s\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4648 calla na suspendSource tcb_src cthread\<^esub> (?R'4648 calla na suspendSource tcb_src cthread) IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>rv. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> sa \<in> {s. tcb_dest_'_update (\<lambda>_. ksCurThread_' (globals s)) (tcb_src_'_update (\<lambda>_. tcb_src) (arch_'_update (\<lambda>_. arch_' s) s)) \<in> UNIV} \<inter> ?R'4696 calla na suspendSource tcb_src cthread y (xfdc s) rv}}
 10. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> {s. (s \<in> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'4648 calla na suspendSource tcb_src (thread_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5366 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?Q'5364 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (if rv = Structures_H.thread_state.Restart then if isCall then do destIPCBuffer <- lookupIPCBuffer True thread;
y <- asUser thread (setRegister Notification_H.badgeRegister 0);
y <- stateAssert (tcb_at' thread) [];
y <- mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply));
y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od else do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od else return (Inr ())) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>?Q5366 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
 7. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 8. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>?Q4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>, \<lbrace>?QE4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4696 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y rv' self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> {s'. \<forall>rva sa. (sa, s') \<in> rf_sr \<and> ?Q5348 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva sa \<longrightarrow> s' \<in> {s'. \<forall>rvb sa. (sa, s') \<in> rf_sr \<and> ?Q5366 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb sa \<longrightarrow> s' \<in> ?Q'5364 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb}})) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''4693 calla na suspendSource tcb_src cthread y rv' self err (e_' s) (errstate s)))}
 10. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>\<lambda>y s. \<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R4703 calla na suspendSource tcb_src cthread y rv) s\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5377 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?S5378 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (if isCall then do destIPCBuffer <- lookupIPCBuffer True thread;
y <- asUser thread (setRegister Notification_H.badgeRegister 0);
y <- stateAssert (tcb_at' thread) [];
y <- mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply));
y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od else do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> ?Q5377 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
 7. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 8. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>?Q4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>, \<lbrace>?QE4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4696 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y rv' self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> {s'. \<forall>rva sa. (sa, s') \<in> rf_sr \<and> ?Q5348 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva sa \<longrightarrow> s' \<in> {s'. \<forall>rvb sa. (sa, s') \<in> rf_sr \<and> (rvb = Structures_H.thread_state.Restart \<longrightarrow> ?Q5377 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb sa) \<and> (rvb \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False) \<longrightarrow> s' \<in> {sa. (rvb = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> ?S5378 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb) \<and> (rvb \<noteq> Structures_H.thread_state.Restart \<longrightarrow> sa \<in> UNIV)}}})) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''4693 calla na suspendSource tcb_src cthread y rv' self err (e_' s) (errstate s)))}
 10. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>\<lambda>y s. \<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R4703 calla na suspendSource tcb_src cthread y rv) s\<rbrace>
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5388 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?S5391 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do destIPCBuffer <- lookupIPCBuffer True thread;
y <- asUser thread (setRegister Notification_H.badgeRegister 0);
y <- stateAssert (tcb_at' thread) [];
y <- mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply));
y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ?Q5388 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
 8. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 9. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>?Q4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>, \<lbrace>?QE4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4696 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y rv' self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> {s'. \<forall>rva sa. (sa, s') \<in> rf_sr \<and> ?Q5348 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva sa \<longrightarrow> s' \<in> {s'. \<forall>rvb sa. (sa, s') \<in> rf_sr \<and> (rvb = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ?Q5388 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb sa) \<and> (\<not> isCall \<longrightarrow> ?R5387 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb sa)) \<and> (rvb \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False) \<longrightarrow> s' \<in> {sa. (rvb = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> {sa. (isCall \<longrightarrow> sa \<in> ?S5391 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb) \<and> (\<not> isCall \<longrightarrow> sa \<in> ?T5389 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb)}) \<and> (rvb \<noteq> Structures_H.thread_state.Restart \<longrightarrow> sa \<in> UNIV)}}})) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''4693 calla na suspendSource tcb_src cthread y rv' self err (e_' s) (errstate s)))}
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5388 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) (?S5391 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) [SKIP] (do destIPCBuffer <- lookupIPCBuffer True thread;
y <- asUser thread (setRegister Notification_H.badgeRegister 0);
y <- stateAssert (tcb_at' thread) [];
y <- mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply));
y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ?Q5388 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
 8. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 9. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>?Q4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>, \<lbrace>?QE4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4696 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y rv' self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> {s'. \<forall>rva sa. (sa, s') \<in> rf_sr \<and> ?Q5348 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva sa \<longrightarrow> s' \<in> {s'. \<forall>rvb sa. (sa, s') \<in> rf_sr \<and> (rvb = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ?Q5388 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb sa) \<and> (\<not> isCall \<longrightarrow> ?R5387 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb sa)) \<and> (rvb \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False) \<longrightarrow> s' \<in> {sa. (rvb = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> {sa. (isCall \<longrightarrow> sa \<in> ?S5391 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb) \<and> (\<not> isCall \<longrightarrow> sa \<in> ?T5389 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb)}) \<and> (rvb \<noteq> Structures_H.thread_state.Restart \<longrightarrow> sa \<in> UNIV)}}})) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''4693 calla na suspendSource tcb_src cthread y rv' self err (e_' s) (errstate s)))}
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5388 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) (?S5391 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) [SKIP] (do destIPCBuffer <- lookupIPCBuffer True thread;
y <- asUser thread (setRegister Notification_H.badgeRegister 0);
y <- stateAssert (tcb_at' thread) [];
y <- mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply));
y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
(\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ?Q5388 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
 8. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 9. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>?Q4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>, \<lbrace>?QE4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4696 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y rv' self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> {s'. \<forall>rva sa. (sa, s') \<in> rf_sr \<and> ?Q5348 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva sa \<longrightarrow> s' \<in> {s'. \<forall>rvb sa. (sa, s') \<in> rf_sr \<and> (rvb = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ?Q5388 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb sa) \<and> (\<not> isCall \<longrightarrow> ?R5387 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb sa)) \<and> (rvb \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False) \<longrightarrow> s' \<in> {sa. (rvb = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> {sa. (isCall \<longrightarrow> sa \<in> ?S5391 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb) \<and> (\<not> isCall \<longrightarrow> sa \<in> ?T5389 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb)}) \<and> (rvb \<noteq> Structures_H.thread_state.Restart \<longrightarrow> sa \<in> UNIV)}}})) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''4693 calla na suspendSource tcb_src cthread y rv' self err (e_' s) (errstate s)))}
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5388 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) (?G'5458 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) [SKIP] (do destIPCBuffer <- lookupIPCBuffer True thread;
y <- asUser thread (setRegister Notification_H.badgeRegister 0);
y <- stateAssert (tcb_at' thread) [];
y <- mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply));
y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ?Q5388 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
 8. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 9. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>?Q4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>, \<lbrace>?QE4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4696 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y rv' self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> {s'. \<forall>rva sa. (sa, s') \<in> rf_sr \<and> ?Q5348 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva sa \<longrightarrow> s' \<in> {s'. \<forall>rvb sa. (sa, s') \<in> rf_sr \<and> (rvb = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> ?Q5388 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb sa) \<and> (\<not> isCall \<longrightarrow> ?R5387 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb sa)) \<and> (rvb \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False) \<longrightarrow> s' \<in> {sa. (rvb = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> {sa. (isCall \<longrightarrow> sa \<in> {sa. \<forall>v. ipcBuffer_'_update (\<lambda>_. v) sa \<in> ?G'5458 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb}) \<and> (\<not> isCall \<longrightarrow> sa \<in> ?T5389 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb)}) \<and> (rvb \<noteq> Structures_H.thread_state.Restart \<longrightarrow> sa \<in> UNIV)}}})) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''4693 calla na suspendSource tcb_src cthread y rv' self err (e_' s) (errstate s)))}
A total of 15 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv rva ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) rva ipcBuffer\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5474 calla na suspendSource tcb_src cthread rv' self e reply rv rva) (?Q'5474 calla na suspendSource tcb_src cthread rv' self e reply rv rva ipcBuffer) [SKIP] (do y <- asUser thread (setRegister Notification_H.badgeRegister 0);
y <- stateAssert (tcb_at' thread) [];
y <- mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case rva of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply));
y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case rva of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case rva of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case rva of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>?Q5474 calla na suspendSource tcb_src cthread rv' self e reply rv\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> ?Q'5474 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and ?R5484 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a) b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
 10. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q5474 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer) (?Q'5474 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) [SKIP] (do y <- asUser thread (setRegister Notification_H.badgeRegister 0);
y <- stateAssert (tcb_at' thread) [];
y <- mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply));
y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>?Q5474 calla na suspendSource tcb_src cthread rv' self e reply rv\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> ?Q'5474 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and ?R5484 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a) b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
 10. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
A total of 17 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv) (?Q'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc) [SKIP] (do y <- stateAssert (tcb_at' thread) [];
y <- mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply));
y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>?Q6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv (xfdc s)}
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and ?R5484 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a) b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P6095 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv) (?Q'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc) [SKIP] (do y <- mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply));
y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> ?P6095 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv s\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv (xfdc s)}
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and ?R5484 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a) b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?P6095 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv) (?Q'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc) [SKIP] (do y <- mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply));
y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (\<acute>i :== 0;;
While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> ?P6095 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv s\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv (xfdc s)}
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and ?R5484 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a) b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G6100 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv) (?Q'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc) [SKIP] (do y <- mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply));
y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (\<acute>i :== 0;;
While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (?G6100 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv (xfdc s)}
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and ?R5484 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a) b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ccorres (?r'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc) (?xf'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc) (?P6102 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv) (?Q'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc) [] (mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) (\<acute>i :== 0;;
While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc) rv'a t t' (IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); ?r'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc) (?xf'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (?P6102 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv (xfdc s)}
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
A total of 23 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdca. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdca; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<forall>na<length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)). ccorres dc xfdc (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target) \<lbrace>\<acute>i = word_of_nat na\<rbrace> [] (asUser thread (setRegister (fst (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! na)) (snd (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! na)))) (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> nb < SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = (nb < word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); Suc nb < length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace> asUser thread (setRegister (fst (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb)) (snd (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb))) \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) < 2 ^ word_bits
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>reply na. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < length TCB_H.msgRegisters; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters\<rbrakk> \<Longrightarrow> ccorres dc xfdc (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target) \<lbrace>\<acute>i = word_of_nat na\<rbrace> [] (asUser thread (setRegister (TCB_H.msgRegisters ! na) (reply ! na))) (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> nb < SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = (nb < word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); Suc nb < length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace> asUser thread (setRegister (fst (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb)) (snd (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb))) \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) < 2 ^ word_bits
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
A total of 27 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>reply na. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < length TCB_H.msgRegisters; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q6126 reply na) (?Q'6126 reply na) [] (asUser thread (setRegister (TCB_H.msgRegisters ! na) (reply ! na))) (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)))
 2. \<And>reply na s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < length TCB_H.msgRegisters; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; s' \<in> \<lbrace>\<acute>i = word_of_nat na\<rbrace>\<rbrakk> \<Longrightarrow> ?Q6126 reply na s \<and> s' \<in> ?Q'6126 reply na
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> nb < SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = (nb < word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); Suc nb < length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace> asUser thread (setRegister (fst (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb)) (snd (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb))) \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) < 2 ^ word_bits
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
A total of 28 subgoals... proof (prove)
goal (30 subgoals):
 1. \<And>reply na rv ret__unsigned_long. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < length TCB_H.msgRegisters; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters; ?rv6135 reply na = ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q6134 reply na rv) (?Q'6134 reply na rv ret__unsigned_long) [] (asUser thread (setRegister (TCB_H.msgRegisters ! na) (reply ! na))) (Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],ret__unsigned_long)))
 2. \<And>reply na. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < length TCB_H.msgRegisters; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R6134 reply na\<rbrace> return () \<lbrace>?Q6134 reply na\<rbrace>
 3. \<And>reply na. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < length TCB_H.msgRegisters; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6134 reply na) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]) {s. \<forall>rv. ?rv6135 reply na = ret__unsigned_long_' s \<longrightarrow> s \<in> ?Q'6134 reply na rv (ret__unsigned_long_' s)}
 4. \<And>reply na s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < length TCB_H.msgRegisters; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; s' \<in> \<lbrace>\<acute>i = word_of_nat na\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. True \<and> tcb_at' target s \<and> (True \<and> tcb_at' target s \<longrightarrow> fst (asUser target (getRegister (?reg6135 reply na)) s) = {(?rv6135 reply na, s)})) and ?R6134 reply na) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.frameRegisters.[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr target) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr target\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (?reg6135 reply na)\<rbrace>} \<inter> ?R'6134 reply na \<inter> \<lbrace>\<acute>i < 0xA\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> nb < SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = (nb < word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); Suc nb < length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace> asUser thread (setRegister (fst (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb)) (snd (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb))) \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) < 2 ^ word_bits
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
A total of 30 subgoals... proof (prove)
goal (29 subgoals):
 1. \<And>reply na. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < length TCB_H.msgRegisters; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R6134 reply na\<rbrace> return () \<lbrace>\<lambda>rv _. True\<rbrace>
 2. \<And>reply na. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < length TCB_H.msgRegisters; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6134 reply na) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]) {s. \<forall>rv. ?rv6135 reply na = ret__unsigned_long_' s \<longrightarrow> s \<in> {sa. w_'_update (\<lambda>_. ret__unsigned_long_' s) (reg_'_update (\<lambda>_. kernel_all_global_addresses.msgRegisters.[unat (i_' sa)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (TCB_H.msgRegisters ! na)\<rbrace> \<inter> \<lbrace>\<acute>w = reply ! na\<rbrace>} \<inter> \<lbrace>\<acute>i < 4\<rbrace>}
 3. \<And>reply na s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < length TCB_H.msgRegisters; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; s' \<in> \<lbrace>\<acute>i = word_of_nat na\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. True \<and> tcb_at' target s \<and> (True \<and> tcb_at' target s \<longrightarrow> fst (asUser target (getRegister (?reg6135 reply na)) s) = {(?rv6135 reply na, s)})) and ?R6134 reply na) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.frameRegisters.[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr target) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr target\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (?reg6135 reply na)\<rbrace>} \<inter> ?R'6134 reply na \<inter> \<lbrace>\<acute>i < 0xA\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> nb < SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = (nb < word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); Suc nb < length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace> asUser thread (setRegister (fst (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb)) (snd (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb))) \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) < 2 ^ word_bits
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
A total of 29 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>reply na. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < length TCB_H.msgRegisters; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6134 reply na) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]) {s. \<forall>rv. ?rv6135 reply na = ret__unsigned_long_' s \<longrightarrow> s \<in> {sa. w_'_update (\<lambda>_. ret__unsigned_long_' s) (reg_'_update (\<lambda>_. kernel_all_global_addresses.msgRegisters.[unat (i_' sa)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) sa)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (TCB_H.msgRegisters ! na)\<rbrace> \<inter> \<lbrace>\<acute>w = reply ! na\<rbrace>} \<inter> \<lbrace>\<acute>i < 4\<rbrace>}
 2. \<And>reply na s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < length TCB_H.msgRegisters; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; s' \<in> \<lbrace>\<acute>i = word_of_nat na\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. True \<and> tcb_at' target s \<and> (True \<and> tcb_at' target s \<longrightarrow> fst (asUser target (getRegister (?reg6135 reply na)) s) = {(?rv6135 reply na, s)})) and (\<lambda>a. True)) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.frameRegisters.[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr target) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr target\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (?reg6135 reply na)\<rbrace>} \<inter> ?R'6134 reply na \<inter> \<lbrace>\<acute>i < 0xA\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> nb < SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = (nb < word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); Suc nb < length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace> asUser thread (setRegister (fst (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb)) (snd (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb))) \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) < 2 ^ word_bits
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
A total of 28 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>reply na. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < length TCB_H.msgRegisters; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6134 reply na) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]) \<lbrace>?rv6135 reply na = \<acute>ret__unsigned_long \<longrightarrow> kernel_all_global_addresses.msgRegisters.[unat \<acute>i] = register_from_H (TCB_H.msgRegisters ! na) \<and> \<acute>ret__unsigned_long = reply ! na \<and> \<acute>i < 4\<rbrace>
 2. \<And>reply na s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < length TCB_H.msgRegisters; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; s' \<in> \<lbrace>\<acute>i = word_of_nat na\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. True \<and> tcb_at' target s \<and> (True \<and> tcb_at' target s \<longrightarrow> fst (asUser target (getRegister (?reg6135 reply na)) s) = {(?rv6135 reply na, s)})) and (\<lambda>a. True)) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.frameRegisters.[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr target) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr target\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (?reg6135 reply na)\<rbrace>} \<inter> ?R'6134 reply na \<inter> \<lbrace>\<acute>i < 0xA\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> nb < SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = (nb < word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); Suc nb < length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace> asUser thread (setRegister (fst (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb)) (snd (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb))) \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) < 2 ^ word_bits
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
A total of 28 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>reply na s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < length TCB_H.msgRegisters; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; s' \<in> \<lbrace>\<acute>i = word_of_nat na\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. True \<and> tcb_at' target s \<and> (True \<and> tcb_at' target s \<longrightarrow> fst (asUser target (getRegister (?reg6135 reply na)) s) = {(?rv6135 reply na, s)})) and (\<lambda>a. True)) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.frameRegisters.[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr target) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr target\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (?reg6135 reply na)\<rbrace>} \<inter> \<lbrace>\<forall>t. ?rv6135 reply na = \<^bsup>t\<^esup>ret__unsigned_long \<longrightarrow> kernel_all_global_addresses.msgRegisters.[unat \<acute>i] = register_from_H (TCB_H.msgRegisters ! na) \<and> \<^bsup>t\<^esup>ret__unsigned_long = reply ! na \<and> \<acute>i < 4\<rbrace> \<inter> \<lbrace>\<acute>i < 0xA\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> nb < SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = (nb < word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); Suc nb < length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace> asUser thread (setRegister (fst (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb)) (snd (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb))) \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) < 2 ^ word_bits
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>reply na s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < length TCB_H.msgRegisters; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; i_' s' = word_of_nat na\<rbrakk> \<Longrightarrow> tcb_at' target s \<and> (tcb_at' target s \<longrightarrow> fst (gets ((\<lambda>uc. uc (?reg6135 reply na)) \<circ> asUser_fetch target) s) = {(?rv6135 reply na, s)}) \<and> kernel_all_global_addresses.frameRegisters.[unat (word_of_nat na)] = register_from_H (?reg6135 reply na) \<and> (\<forall>t. ?rv6135 reply na = ret__unsigned_long_' t \<longrightarrow> kernel_all_global_addresses.msgRegisters.[unat (word_of_nat na)] = register_from_H (TCB_H.msgRegisters ! na) \<and> ret__unsigned_long_' t = reply ! na \<and> word_of_nat na < 4) \<and> word_of_nat na < 0xA
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> nb < SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = (nb < word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); Suc nb < length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace> asUser thread (setRegister (fst (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb)) (snd (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb))) \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) < 2 ^ word_bits
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>reply na s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < unat n_msgRegisters; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; i_' s' = word_of_nat na\<rbrakk> \<Longrightarrow> asUser_fetch target s (?reg6135 reply na) = ?rv6135 reply na \<and> kernel_all_global_addresses.frameRegisters.[unat (word_of_nat na)] = register_from_H (?reg6135 reply na) \<and> (\<forall>t. ?rv6135 reply na = ret__unsigned_long_' t \<longrightarrow> kernel_all_global_addresses.msgRegisters.[unat (word_of_nat na)] = register_from_H (TCB_H.msgRegisters ! na) \<and> ret__unsigned_long_' t = reply ! na \<and> word_of_nat na < 4) \<and> word_of_nat na < 0xA
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> nb < SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = (nb < word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); Suc nb < length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace> asUser thread (setRegister (fst (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb)) (snd (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb))) \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) < 2 ^ word_bits
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
A total of 27 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>reply na s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < unat n_msgRegisters; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; i_' s' = word_of_nat na\<rbrakk> \<Longrightarrow> na < 2 ^ word_bits
 2. \<And>reply na s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < unat n_msgRegisters; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; i_' s' = word_of_nat na; unat (word_of_nat na) = na\<rbrakk> \<Longrightarrow> asUser_fetch target s (?reg6135 reply na) = ?rv6135 reply na \<and> kernel_all_global_addresses.frameRegisters.[unat (word_of_nat na)] = register_from_H (?reg6135 reply na) \<and> (\<forall>t. ?rv6135 reply na = ret__unsigned_long_' t \<longrightarrow> kernel_all_global_addresses.msgRegisters.[unat (word_of_nat na)] = register_from_H (TCB_H.msgRegisters ! na) \<and> ret__unsigned_long_' t = reply ! na \<and> word_of_nat na < 4) \<and> word_of_nat na < 0xA
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> nb < SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = (nb < word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); Suc nb < length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace> asUser thread (setRegister (fst (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb)) (snd (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb))) \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) < 2 ^ word_bits
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
A total of 28 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>reply na s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < unat n_msgRegisters; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; i_' s' = word_of_nat na; unat (word_of_nat na) = na\<rbrakk> \<Longrightarrow> asUser_fetch target s (?reg6135 reply na) = ?rv6135 reply na \<and> kernel_all_global_addresses.frameRegisters.[unat (word_of_nat na)] = register_from_H (?reg6135 reply na) \<and> (\<forall>t. ?rv6135 reply na = ret__unsigned_long_' t \<longrightarrow> kernel_all_global_addresses.msgRegisters.[unat (word_of_nat na)] = register_from_H (TCB_H.msgRegisters ! na) \<and> ret__unsigned_long_' t = reply ! na \<and> word_of_nat na < 4) \<and> word_of_nat na < 0xA
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> nb < SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = (nb < word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); Suc nb < length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace> asUser thread (setRegister (fst (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb)) (snd (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb))) \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) < 2 ^ word_bits
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>reply na s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < 4; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; i_' s' = word_of_nat na; unat (word_of_nat na) = na\<rbrakk> \<Longrightarrow> asUser_fetch target s (?reg6135 reply na) = ?rv6135 reply na \<and> kernel_all_global_addresses.frameRegisters.[na] = register_from_H (?reg6135 reply na) \<and> (\<forall>t. ?rv6135 reply na = ret__unsigned_long_' t \<longrightarrow> ret__unsigned_long_' t = reply ! na)
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> nb < SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = (nb < word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); Suc nb < length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace> asUser thread (setRegister (fst (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb)) (snd (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb))) \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) < 2 ^ word_bits
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
A total of 27 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>reply na s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < 4; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; i_' s' = word_of_nat na; unat (word_of_nat na) = na; na < unat n_frameRegisters\<rbrakk> \<Longrightarrow> asUser_fetch target s (?reg6135 reply na) = ?rv6135 reply na \<and> kernel_all_global_addresses.frameRegisters.[na] = register_from_H (?reg6135 reply na) \<and> (\<forall>t. ?rv6135 reply na = ret__unsigned_long_' t \<longrightarrow> ret__unsigned_long_' t = reply ! na)
 2. \<And>reply na s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < 4; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; i_' s' = word_of_nat na; unat (word_of_nat na) = na\<rbrakk> \<Longrightarrow> na < unat n_frameRegisters
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> nb < SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = (nb < word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); Suc nb < length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace> asUser thread (setRegister (fst (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb)) (snd (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb))) \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) < 2 ^ word_bits
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
A total of 28 subgoals... proof (prove)
goal (30 subgoals):
 1. \<And>reply na s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < 4; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; i_' s' = word_of_nat na; unat (word_of_nat na) = na; na < unat n_frameRegisters; ?rv6135 reply na = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> ret__unsigned_long_' t = reply ! na
 2. \<And>reply na s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < 4; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; i_' s' = word_of_nat na; unat (word_of_nat na) = na; na < unat n_frameRegisters\<rbrakk> \<Longrightarrow> kernel_all_global_addresses.frameRegisters.[na] = register_from_H (?reg6135 reply na)
 3. \<And>reply na s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < 4; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; i_' s' = word_of_nat na; unat (word_of_nat na) = na; na < unat n_frameRegisters\<rbrakk> \<Longrightarrow> asUser_fetch target s (?reg6135 reply na) = ?rv6135 reply na
 4. \<And>reply na s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < 4; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; i_' s' = word_of_nat na; unat (word_of_nat na) = na\<rbrakk> \<Longrightarrow> na < unat n_frameRegisters
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> nb < SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = (nb < word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); Suc nb < length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace> asUser thread (setRegister (fst (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb)) (snd (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb))) \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) < 2 ^ word_bits
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
A total of 30 subgoals... proof (prove)
goal (29 subgoals):
 1. \<And>reply na s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < 4; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; i_' s' = word_of_nat na; unat (word_of_nat na) = na; na < unat n_frameRegisters\<rbrakk> \<Longrightarrow> kernel_all_global_addresses.frameRegisters.[na] = register_from_H (?reg6135 reply na)
 2. \<And>reply na s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < 4; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; i_' s' = word_of_nat na; unat (word_of_nat na) = na; na < unat n_frameRegisters\<rbrakk> \<Longrightarrow> asUser_fetch target s (?reg6135 reply na) = reply ! na
 3. \<And>reply na s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < 4; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; i_' s' = word_of_nat na; unat (word_of_nat na) = na\<rbrakk> \<Longrightarrow> na < unat n_frameRegisters
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> nb < SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = (nb < word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); Suc nb < length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace> asUser thread (setRegister (fst (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb)) (snd (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb))) \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) < 2 ^ word_bits
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
A total of 29 subgoals... proof (prove)
goal (29 subgoals):
 1. \<And>reply na s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < 4; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; i_' s' = word_of_nat na; unat (word_of_nat na) = na; na < unat n_frameRegisters\<rbrakk> \<Longrightarrow> na < length TCB_H.frameRegisters
 2. \<And>reply na s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < 4; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; i_' s' = word_of_nat na; unat (word_of_nat na) = na; na < unat n_frameRegisters\<rbrakk> \<Longrightarrow> asUser_fetch target s (TCB_H.frameRegisters ! na) = reply ! na
 3. \<And>reply na s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < 4; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; i_' s' = word_of_nat na; unat (word_of_nat na) = na\<rbrakk> \<Longrightarrow> na < unat n_frameRegisters
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> nb < SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = (nb < word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); Suc nb < length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace> asUser thread (setRegister (fst (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb)) (snd (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb))) \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) < 2 ^ word_bits
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
A total of 29 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>reply na s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < 4; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; i_' s' = word_of_nat na; unat (word_of_nat na) = na; na < unat n_frameRegisters\<rbrakk> \<Longrightarrow> asUser_fetch target s (TCB_H.frameRegisters ! na) = reply ! na
 2. \<And>reply na s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < 4; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; i_' s' = word_of_nat na; unat (word_of_nat na) = na\<rbrakk> \<Longrightarrow> na < unat n_frameRegisters
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> nb < SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = (nb < word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); Suc nb < length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace> asUser thread (setRegister (fst (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb)) (snd (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb))) \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) < 2 ^ word_bits
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
A total of 28 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>reply na s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < 4; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; unat (word_of_nat na) = na; na < unat n_frameRegisters; \<exists>ko. ko_at' ko target s \<and> map (atcbContextGet (tcbArch ko)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply\<rbrakk> \<Longrightarrow> asUser_fetch target s (TCB_H.frameRegisters ! na) = reply ! na
 2. \<And>reply na s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < 4; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; i_' s' = word_of_nat na; unat (word_of_nat na) = na\<rbrakk> \<Longrightarrow> na < unat n_frameRegisters
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> nb < SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = (nb < word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); Suc nb < length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace> asUser thread (setRegister (fst (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb)) (snd (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb))) \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) < 2 ^ word_bits
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
A total of 28 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>reply na s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); na < 4; na < unat n; na < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; i_' s' = word_of_nat na; unat (word_of_nat na) = na\<rbrakk> \<Longrightarrow> na < unat n_frameRegisters
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> nb < SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = (nb < word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); Suc nb < length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace> asUser thread (setRegister (fst (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb)) (snd (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb))) \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) < 2 ^ word_bits
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
A total of 27 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> nb < SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = (nb < word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); Suc nb < length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace> asUser thread (setRegister (fst (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb)) (snd (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb))) \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) < 2 ^ word_bits
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread e reply state destIPCBuffer ipcBuffer nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) 19\<rbrakk> \<Longrightarrow> (destIPCBuffer = None \<longrightarrow> (nb < n \<and> nb < 0xA \<and> nb < 4) = (nb < word_of_nat (min (min (unat n) 19) 4))) \<and> ((\<exists>x2. destIPCBuffer = Some x2) \<longrightarrow> (nb < n \<and> nb < 0xA \<and> nb < 4) = (nb < word_of_nat (min 4 (min (unat n) 19))))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); Suc nb < length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace> asUser thread (setRegister (fst (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb)) (snd (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb))) \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) < 2 ^ word_bits
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread e reply state destIPCBuffer ipcBuffer nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = (if unat n \<le> 19 then unat n else 19)\<rbrakk> \<Longrightarrow> (unat n = 4 \<longrightarrow> (unat nb < 4 \<and> unat nb < 10 \<and> unat nb < 4) = (unat nb < 4)) \<and> (unat n \<noteq> 4 \<longrightarrow> (unat n \<le> 19 \<longrightarrow> (4 \<le> unat n \<longrightarrow> (unat nb < unat n \<and> unat nb < 10 \<and> unat nb < 4) = (unat nb < 4)) \<and> (\<not> 4 \<le> unat n \<longrightarrow> (unat nb < unat n \<and> unat nb < 10 \<and> unat nb < 4) = (unat nb < unat n))) \<and> (\<not> unat n \<le> 19 \<longrightarrow> (unat nb < unat n \<and> unat nb < 10 \<and> unat nb < 4) = (unat nb < 4)))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); Suc nb < length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace> asUser thread (setRegister (fst (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb)) (snd (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb))) \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) < 2 ^ word_bits
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
A total of 26 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); Suc nb < length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace> asUser thread (setRegister (fst (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb)) (snd (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb))) \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) < 2 ^ word_bits
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc s. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> {s} \<subseteq> \<lbrace>\<acute>i < 0xA \<longrightarrow> \<acute>i < 4 \<longrightarrow> \<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); Suc nb < length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace> asUser thread (setRegister (fst (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb)) (snd (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb))) \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) < 2 ^ word_bits
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
A total of 25 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); Suc nb < length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace> asUser thread (setRegister (fst (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb)) (snd (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply) ! nb))) \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) < 2 ^ word_bits
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
A total of 24 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc nb s. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); Suc nb < length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)); obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s\<rbrakk> \<Longrightarrow> (K (thread \<noteq> target) and obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target) s
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) < 2 ^ word_bits
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
A total of 24 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) < 2 ^ word_bits
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
A total of 23 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (IF ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc rv'a)
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 22 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF ipcBuffer \<noteq> NULL \<and> rv'a < n \<and> rv'a < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and ?R5484 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a) b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y) (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc y rv'a) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (length TCB_H.msgRegisters) (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF ipcBuffer \<noteq> NULL \<and> rv'a < n \<and> rv'a < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and ?R5484 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a) b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?Q'6101 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [SKIP] (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF ipcBuffer \<noteq> NULL \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and ?R5484 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a) b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
A total of 21 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a s s'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); ?Q6101 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () s; s' \<in> ?Q'6101 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))); (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> (do y <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) s = ?b6782 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a s
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?Q'6101 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [SKIP] (?b6782 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a) (IF ipcBuffer \<noteq> NULL \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 22 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a s s'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); ?Q6101 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () s; s' \<in> ?Q'6101 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))); (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) s = ?f'6790 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a s (?s'6791 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a s)
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?Q'6101 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [SKIP] (\<lambda>s. (do rv <- ?f'6790 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a s;
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?s'6791 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a s)) (IF ipcBuffer \<noteq> NULL \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 22 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6101 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?Q'6101 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [SKIP] (do rv <- do _ <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))
od;
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF ipcBuffer \<noteq> NULL \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>?Q6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and ?R5484 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a) b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G6798 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?Q'6101 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [SKIP] (do rv <- do _ <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))
od;
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF ipcBuffer \<noteq> NULL \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. ?G6798 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and ?R5484 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a) b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
A total of 21 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G6798 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?Q'6101 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [SKIP] (do rv <- do _ <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))
od;
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF ipcBuffer \<noteq> NULL \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0\<rbrakk> \<Longrightarrow> (ipcBuffer = NULL) = (destIPCBuffer = None)
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. ?G6798 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 22 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0\<rbrakk> \<Longrightarrow> (ipcBuffer = NULL) = (destIPCBuffer = None)
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G6798 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?Q'6101 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [SKIP] (do rv <- do _ <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))
od;
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF ipcBuffer \<noteq> NULL \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. ?G6798 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 22 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G6798 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?Q'6101 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [SKIP] (do rv <- do _ <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))
od;
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF ipcBuffer \<noteq> NULL \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. ?G6798 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and ?R5484 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a) b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?G6798 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?Q'6101 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [SKIP] (do _ <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. ?G6798 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and ?R5484 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a) b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
A total of 21 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?P6835 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?Q'6101 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) (IF (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI)
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. ?P6835 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (?Q'6101 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
A total of 25 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q6841 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?S6844 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) (While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>aa. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> ?Q6841 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a aa) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> ?R6840 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a aa)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a aa. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> aa < na \<and> aa < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> ?S6844 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a aa) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> aa < na \<and> aa < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> ?T6842 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a aa)})
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
A total of 26 subgoals... proof (prove)
goal (31 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdca rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>na<length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))). ccorres dc xfdc (\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s) \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters) + word_of_nat na\<rbrace> [] (storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! na)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! na))) (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
A total of 31 subgoals... proof (prove)
goal (31 subgoals):
 1. \<And>reply na y. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; option_to_ptr (Some y) \<noteq> NULL; na < min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + (Suc (unat msgMaxLength) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))) - unat n_msgRegisters \<and> na < unat n_frameRegisters - unat n_msgRegisters \<and> na < unat n; word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + (Suc (unat msgMaxLength) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))))) < n; word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + (Suc (unat msgMaxLength) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' y s \<and> valid_pspace' s) \<lbrace>\<acute>i = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na\<rbrace> [] (storeWordUser (fst (zip (map (\<lambda>x. y + x * 4) [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + (Suc (unat msgMaxLength) - unat (1 + word_of_nat (length TCB_H.msgRegisters))))) reply)) ! na)) (snd (zip (map (\<lambda>x. y + x * 4) [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + (Suc (unat msgMaxLength) - unat (1 + word_of_nat (length TCB_H.msgRegisters))))) reply)) ! na))) (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (option_to_ptr (Some y)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (option_to_ptr (Some y) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (option_to_ptr (Some y)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (option_to_ptr (Some y) +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
A total of 31 subgoals... proof (prove)
goal (31 subgoals):
 1. \<And>reply na y. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; option_to_ptr (Some y) \<noteq> NULL; na + unat n_msgRegisters < unat n \<and> na + unat n_msgRegisters < unat n_frameRegisters + unat n_gpRegisters \<and> na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength) \<and> na + unat n_msgRegisters < unat n_frameRegisters \<and> na < unat n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' y s \<and> valid_pspace' s) \<lbrace>\<acute>i = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na\<rbrace> [] (storeWordUser (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (Suc (unat n_msgRegisters + unat msgMaxLength) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))) reply) ! na)) (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (option_to_ptr (Some y)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (option_to_ptr (Some y) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (option_to_ptr (Some y)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (option_to_ptr (Some y) +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
A total of 31 subgoals... proof (prove)
goal (32 subgoals):
 1. \<And>reply na y. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; option_to_ptr (Some y) \<noteq> NULL; na + unat n_msgRegisters < unat n \<and> na + unat n_msgRegisters < unat n_frameRegisters + unat n_gpRegisters \<and> na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength) \<and> na + unat n_msgRegisters < unat n_frameRegisters \<and> na < unat n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q6871 reply na y) (?Q'6871 reply na y) [] (storeWordUser (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (Suc (unat n_msgRegisters + unat msgMaxLength) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))) reply) ! na)) (Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (option_to_ptr (Some y)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (option_to_ptr (Some y) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (option_to_ptr (Some y)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (option_to_ptr (Some y) +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))))
 2. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; option_to_ptr (Some y) \<noteq> NULL; na + unat n_msgRegisters < unat n \<and> na + unat n_msgRegisters < unat n_frameRegisters + unat n_gpRegisters \<and> na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength) \<and> na + unat n_msgRegisters < unat n_frameRegisters \<and> na < unat n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' y s \<and> valid_pspace' s; s' \<in> \<lbrace>\<acute>i = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na\<rbrace>\<rbrakk> \<Longrightarrow> ?Q6871 reply na y s \<and> s' \<in> ?Q'6871 reply na y
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
A total of 32 subgoals... proof (prove)
goal (34 subgoals):
 1. \<And>reply na y rv ret__unsigned_long. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; option_to_ptr (Some y) \<noteq> NULL; na + unat n_msgRegisters < unat n \<and> na + unat n_msgRegisters < unat n_frameRegisters + unat n_gpRegisters \<and> na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength) \<and> na + unat n_msgRegisters < unat n_frameRegisters \<and> na < unat n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; ?rv6880 reply na y = ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q6879 reply na y rv) (?Q'6879 reply na y rv ret__unsigned_long) [] (storeWordUser (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (Suc (unat n_msgRegisters + unat msgMaxLength) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))) reply) ! na)) (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (option_to_ptr (Some y)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (option_to_ptr (Some y) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (option_to_ptr (Some y)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (option_to_ptr (Some y) +\<^sub>p uint (\<acute>i + 1)) ret__unsigned_long))))))
 2. \<And>reply na y. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; option_to_ptr (Some y) \<noteq> NULL; na + unat n_msgRegisters < unat n \<and> na + unat n_msgRegisters < unat n_frameRegisters + unat n_gpRegisters \<and> na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength) \<and> na + unat n_msgRegisters < unat n_frameRegisters \<and> na < unat n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R6879 reply na y\<rbrace> return () \<lbrace>?Q6879 reply na y\<rbrace>
 3. \<And>reply na y. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; option_to_ptr (Some y) \<noteq> NULL; na + unat n_msgRegisters < unat n \<and> na + unat n_msgRegisters < unat n_frameRegisters + unat n_gpRegisters \<and> na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength) \<and> na + unat n_msgRegisters < unat n_frameRegisters \<and> na < unat n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6879 reply na y) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]) {s. \<forall>rv. ?rv6880 reply na y = ret__unsigned_long_' s \<longrightarrow> s \<in> ?Q'6879 reply na y rv (ret__unsigned_long_' s)}
 4. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; option_to_ptr (Some y) \<noteq> NULL; na + unat n_msgRegisters < unat n \<and> na + unat n_msgRegisters < unat n_frameRegisters + unat n_gpRegisters \<and> na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength) \<and> na + unat n_msgRegisters < unat n_frameRegisters \<and> na < unat n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' y s \<and> valid_pspace' s; s' \<in> \<lbrace>\<acute>i = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. True \<and> tcb_at' target s \<and> (True \<and> tcb_at' target s \<longrightarrow> fst (asUser target (getRegister (?reg6880 reply na y)) s) = {(?rv6880 reply na y, s)})) and ?R6879 reply na y) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.frameRegisters.[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr target) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr target\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (?reg6880 reply na y)\<rbrace>} \<inter> ?R'6879 reply na y \<inter> \<lbrace>\<acute>i < 0xA\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
A total of 34 subgoals... proof (prove)
goal (34 subgoals):
 1. \<And>reply na y rv ret__unsigned_long. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; option_to_ptr (Some y) \<noteq> NULL; na + unat n_msgRegisters < unat n \<and> na + unat n_msgRegisters < unat n_frameRegisters + unat n_gpRegisters \<and> na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength) \<and> na + unat n_msgRegisters < unat n_frameRegisters \<and> na < unat n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; ?rv6880 reply na y = ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A6940 reply na y rv) (?C'6939 reply na y rv ret__unsigned_long) [] (storeWordUser (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (Suc (unat n_msgRegisters + unat msgMaxLength) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))) reply) ! na)) (Guard C_Guard {s. s \<Turnstile>\<^sub>c (option_to_ptr (Some y) +\<^sub>p uint (i_' s + 1))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (option_to_ptr (Some y) +\<^sub>p uint (\<acute>i + 1)) ret__unsigned_long))))
 2. \<And>reply na y. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; option_to_ptr (Some y) \<noteq> NULL; na + unat n_msgRegisters < unat n \<and> na + unat n_msgRegisters < unat n_frameRegisters + unat n_gpRegisters \<and> na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength) \<and> na + unat n_msgRegisters < unat n_frameRegisters \<and> na < unat n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R6879 reply na y\<rbrace> return () \<lbrace>\<lambda>rv. ?A6940 reply na y rv and valid_ipc_buffer_ptr' (ptr_val (option_to_ptr (Some y))) and valid_ipc_buffer_ptr' (ptr_val (option_to_ptr (Some y)))\<rbrace>
 3. \<And>reply na y. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; option_to_ptr (Some y) \<noteq> NULL; na + unat n_msgRegisters < unat n \<and> na + unat n_msgRegisters < unat n_frameRegisters + unat n_gpRegisters \<and> na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength) \<and> na + unat n_msgRegisters < unat n_frameRegisters \<and> na < unat n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6879 reply na y) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]) {s. \<forall>rv. ?rv6880 reply na y = ret__unsigned_long_' s \<longrightarrow> s \<in> ?C'6939 reply na y rv (ret__unsigned_long_' s) \<inter> \<lbrace>Suc (unat (\<acute>i + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> Suc (unat (\<acute>i + 1)) \<noteq> 0)\<rbrace> \<inter> \<lbrace>unat (\<acute>i + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> unat (\<acute>i + 1) \<noteq> 0)\<rbrace>}
 4. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; option_to_ptr (Some y) \<noteq> NULL; na + unat n_msgRegisters < unat n \<and> na + unat n_msgRegisters < unat n_frameRegisters + unat n_gpRegisters \<and> na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength) \<and> na + unat n_msgRegisters < unat n_frameRegisters \<and> na < unat n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' y s \<and> valid_pspace' s; s' \<in> \<lbrace>\<acute>i = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. True \<and> tcb_at' target s \<and> (True \<and> tcb_at' target s \<longrightarrow> fst (asUser target (getRegister (?reg6880 reply na y)) s) = {(?rv6880 reply na y, s)})) and ?R6879 reply na y) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.frameRegisters.[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr target) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr target\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (?reg6880 reply na y)\<rbrace>} \<inter> ?R'6879 reply na y \<inter> \<lbrace>\<acute>i < 0xA\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
A total of 34 subgoals... proof (prove)
goal (33 subgoals):
 1. \<And>reply na y. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; option_to_ptr (Some y) \<noteq> NULL; na + unat n_msgRegisters < unat n \<and> na + unat n_msgRegisters < unat n_frameRegisters + unat n_gpRegisters \<and> na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength) \<and> na + unat n_msgRegisters < unat n_frameRegisters \<and> na < unat n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R6879 reply na y\<rbrace> return () \<lbrace>\<lambda>rv. valid_pspace' and (\<lambda>_. is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4) 2) and valid_ipc_buffer_ptr' (ptr_val (option_to_ptr (Some y))) and valid_ipc_buffer_ptr' (ptr_val (option_to_ptr (Some y)))\<rbrace>
 2. \<And>reply na y. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; option_to_ptr (Some y) \<noteq> NULL; na + unat n_msgRegisters < unat n \<and> na + unat n_msgRegisters < unat n_frameRegisters + unat n_gpRegisters \<and> na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength) \<and> na + unat n_msgRegisters < unat n_frameRegisters \<and> na < unat n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6879 reply na y) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]) {s. \<forall>rv. ?rv6880 reply na y = ret__unsigned_long_' s \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>option_to_ptr (Some y) +\<^sub>p uint (\<acute>i + 1) = PTR(32 word) (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4)\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned_long = drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (Suc (unat n_msgRegisters + unat msgMaxLength) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))) reply) ! na\<rbrace> \<inter> \<lbrace>Suc (unat (\<acute>i + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> Suc (unat (\<acute>i + 1)) \<noteq> 0)\<rbrace> \<inter> \<lbrace>unat (\<acute>i + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> unat (\<acute>i + 1) \<noteq> 0)\<rbrace>}
 3. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; option_to_ptr (Some y) \<noteq> NULL; na + unat n_msgRegisters < unat n \<and> na + unat n_msgRegisters < unat n_frameRegisters + unat n_gpRegisters \<and> na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength) \<and> na + unat n_msgRegisters < unat n_frameRegisters \<and> na < unat n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' y s \<and> valid_pspace' s; s' \<in> \<lbrace>\<acute>i = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. True \<and> tcb_at' target s \<and> (True \<and> tcb_at' target s \<longrightarrow> fst (asUser target (getRegister (?reg6880 reply na y)) s) = {(?rv6880 reply na y, s)})) and ?R6879 reply na y) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.frameRegisters.[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr target) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr target\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (?reg6880 reply na y)\<rbrace>} \<inter> ?R'6879 reply na y \<inter> \<lbrace>\<acute>i < 0xA\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
A total of 33 subgoals... proof (prove)
goal (32 subgoals):
 1. \<And>reply na y. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; option_to_ptr (Some y) \<noteq> NULL; na + unat n_msgRegisters < unat n \<and> na + unat n_msgRegisters < unat n_frameRegisters + unat n_gpRegisters \<and> na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength) \<and> na + unat n_msgRegisters < unat n_frameRegisters \<and> na < unat n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6879 reply na y) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]) {s. \<forall>rv. ?rv6880 reply na y = ret__unsigned_long_' s \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>option_to_ptr (Some y) +\<^sub>p uint (\<acute>i + 1) = PTR(32 word) (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4)\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned_long = drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (Suc (unat n_msgRegisters + unat msgMaxLength) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))) reply) ! na\<rbrace> \<inter> \<lbrace>Suc (unat (\<acute>i + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> Suc (unat (\<acute>i + 1)) \<noteq> 0)\<rbrace> \<inter> \<lbrace>unat (\<acute>i + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> unat (\<acute>i + 1) \<noteq> 0)\<rbrace>}
 2. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; option_to_ptr (Some y) \<noteq> NULL; na + unat n_msgRegisters < unat n \<and> na + unat n_msgRegisters < unat n_frameRegisters + unat n_gpRegisters \<and> na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength) \<and> na + unat n_msgRegisters < unat n_frameRegisters \<and> na < unat n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' y s \<and> valid_pspace' s; s' \<in> \<lbrace>\<acute>i = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. True \<and> tcb_at' target s \<and> (True \<and> tcb_at' target s \<longrightarrow> fst (asUser target (getRegister (?reg6880 reply na y)) s) = {(?rv6880 reply na y, s)})) and (valid_pspace' and (\<lambda>_. is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4) 2) and valid_ipc_buffer_ptr' (ptr_val (option_to_ptr (Some y))) and valid_ipc_buffer_ptr' (ptr_val (option_to_ptr (Some y))))) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.frameRegisters.[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr target) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr target\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (?reg6880 reply na y)\<rbrace>} \<inter> ?R'6879 reply na y \<inter> \<lbrace>\<acute>i < 0xA\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
A total of 32 subgoals... proof (prove)
goal (31 subgoals):
 1. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; option_to_ptr (Some y) \<noteq> NULL; na + unat n_msgRegisters < unat n \<and> na + unat n_msgRegisters < unat n_frameRegisters + unat n_gpRegisters \<and> na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength) \<and> na + unat n_msgRegisters < unat n_frameRegisters \<and> na < unat n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' y s \<and> valid_pspace' s; s' \<in> \<lbrace>\<acute>i = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. True \<and> tcb_at' target s \<and> (True \<and> tcb_at' target s \<longrightarrow> fst (asUser target (getRegister (?reg6880 reply na y)) s) = {(?rv6880 reply na y, s)})) and (valid_pspace' and (\<lambda>_. is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4) 2) and valid_ipc_buffer_ptr' (ptr_val (option_to_ptr (Some y))) and valid_ipc_buffer_ptr' (ptr_val (option_to_ptr (Some y))))) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.frameRegisters.[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr target) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr target\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (?reg6880 reply na y)\<rbrace>} \<inter> \<lbrace>\<forall>t. ?rv6880 reply na y = \<^bsup>t\<^esup>ret__unsigned_long \<longrightarrow> option_to_ptr (Some y) +\<^sub>p uint (\<acute>i + 1) = PTR(32 word) (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4) \<and> \<^bsup>t\<^esup>ret__unsigned_long = drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (Suc (unat n_msgRegisters + unat msgMaxLength) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))) reply) ! na \<and> Suc (unat (\<acute>i + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> Suc (unat (\<acute>i + 1)) \<noteq> 0) \<and> unat (\<acute>i + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> unat (\<acute>i + 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>\<acute>i < 0xA\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
A total of 31 subgoals... proof (prove)
goal (31 subgoals):
 1. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (?reg6880 reply na y)) s) = {(?rv6880 reply na y, s)} \<and> is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4) 2 \<and> kernel_all_global_addresses.frameRegisters.[unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na)] = register_from_H (?reg6880 reply na y) \<and> (\<forall>t. ?rv6880 reply na y = ret__unsigned_long_' t \<longrightarrow> UCAST(32 signed \<rightarrow> 32) n_msgRegisters * 4 + word_of_nat na * 4 + 4 = [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4 \<and> ret__unsigned_long_' t = reply ! (unat n_msgRegisters + na) \<and> Suc (unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na + 1) \<le> 2 ^ (msg_align_bits - 2)) \<and> UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na < 0xA
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
A total of 31 subgoals... proof (prove)
goal (38 subgoals):
 1. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na < 0xA
 2. \<And>reply na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters; ?rv6880 reply na y = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na + 1) \<le> 2 ^ (msg_align_bits - 2)
 3. \<And>reply na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters; ?rv6880 reply na y = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> Suc (unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na + 1)) \<le> 2 ^ (msg_align_bits - 2)
 4. \<And>reply na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters; ?rv6880 reply na y = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> ret__unsigned_long_' t = reply ! (unat n_msgRegisters + na)
 5. \<And>reply na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters; ?rv6880 reply na y = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> UCAST(32 signed \<rightarrow> 32) n_msgRegisters * 4 + word_of_nat na * 4 + 4 = [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4
 6. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> kernel_all_global_addresses.frameRegisters.[unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na)] = register_from_H (?reg6880 reply na y)
 7. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4) 2
 8. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (?reg6880 reply na y)) s) = {(?rv6880 reply na y, s)}
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
A total of 38 subgoals... proof (prove)
goal (38 subgoals):
 1. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (10 + unat n_gpRegisters); y \<noteq> 0; (s, s') \<in> rf_sr; i_' s' = 4 + word_of_nat na; na + 4 < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na < 6\<rbrakk> \<Longrightarrow> unat (4 + word_of_nat na) < 10
 2. \<And>reply na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters; ?rv6880 reply na y = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na + 1) \<le> 2 ^ (msg_align_bits - 2)
 3. \<And>reply na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters; ?rv6880 reply na y = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> Suc (unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na + 1)) \<le> 2 ^ (msg_align_bits - 2)
 4. \<And>reply na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters; ?rv6880 reply na y = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> ret__unsigned_long_' t = reply ! (unat n_msgRegisters + na)
 5. \<And>reply na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters; ?rv6880 reply na y = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> UCAST(32 signed \<rightarrow> 32) n_msgRegisters * 4 + word_of_nat na * 4 + 4 = [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4
 6. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> kernel_all_global_addresses.frameRegisters.[unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na)] = register_from_H (?reg6880 reply na y)
 7. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4) 2
 8. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (?reg6880 reply na y)) s) = {(?rv6880 reply na y, s)}
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
A total of 38 subgoals... proof (prove)
goal (37 subgoals):
 1. \<And>reply na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters; ?rv6880 reply na y = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na + 1) \<le> 2 ^ (msg_align_bits - 2)
 2. \<And>reply na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters; ?rv6880 reply na y = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> Suc (unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na + 1)) \<le> 2 ^ (msg_align_bits - 2)
 3. \<And>reply na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters; ?rv6880 reply na y = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> ret__unsigned_long_' t = reply ! (unat n_msgRegisters + na)
 4. \<And>reply na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters; ?rv6880 reply na y = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> UCAST(32 signed \<rightarrow> 32) n_msgRegisters * 4 + word_of_nat na * 4 + 4 = [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4
 5. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> kernel_all_global_addresses.frameRegisters.[unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na)] = register_from_H (?reg6880 reply na y)
 6. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4) 2
 7. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (?reg6880 reply na y)) s) = {(?rv6880 reply na y, s)}
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
A total of 37 subgoals... proof (prove)
goal (37 subgoals):
 1. \<And>reply na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters; ?rv6880 reply na y = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> ret__unsigned_long_' t = reply ! (unat n_msgRegisters + na)
 2. \<And>reply na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters; ?rv6880 reply na y = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na + 1) \<le> 2 ^ (msg_align_bits - 2)
 3. \<And>reply na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters; ?rv6880 reply na y = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> Suc (unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na + 1)) \<le> 2 ^ (msg_align_bits - 2)
 4. \<And>reply na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters; ?rv6880 reply na y = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> UCAST(32 signed \<rightarrow> 32) n_msgRegisters * 4 + word_of_nat na * 4 + 4 = [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4
 5. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> kernel_all_global_addresses.frameRegisters.[unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na)] = register_from_H (?reg6880 reply na y)
 6. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4) 2
 7. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (?reg6880 reply na y)) s) = {(?rv6880 reply na y, s)}
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
A total of 37 subgoals... proof (prove)
goal (36 subgoals):
 1. \<And>reply na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters; reply ! (unat n_msgRegisters + na) = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na + 1) \<le> 2 ^ (msg_align_bits - 2)
 2. \<And>reply na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters; reply ! (unat n_msgRegisters + na) = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> Suc (unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na + 1)) \<le> 2 ^ (msg_align_bits - 2)
 3. \<And>reply na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters; reply ! (unat n_msgRegisters + na) = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> UCAST(32 signed \<rightarrow> 32) n_msgRegisters * 4 + word_of_nat na * 4 + 4 = [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4
 4. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> kernel_all_global_addresses.frameRegisters.[unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na)] = register_from_H (?reg6880 reply na y)
 5. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4) 2
 6. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (?reg6880 reply na y)) s) = {(reply ! (unat n_msgRegisters + na), s)}
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
A total of 36 subgoals... proof (prove)
goal (36 subgoals):
 1. \<And>reply na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; 4 < n; 4 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = 4 + word_of_nat na; na + 4 < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na < 116; na + 4 < unat n_frameRegisters; reply ! (4 + na) = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> unat (5 + word_of_nat na) \<le> 128
 2. \<And>reply na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters; reply ! (unat n_msgRegisters + na) = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> Suc (unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na + 1)) \<le> 2 ^ (msg_align_bits - 2)
 3. \<And>reply na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters; reply ! (unat n_msgRegisters + na) = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> UCAST(32 signed \<rightarrow> 32) n_msgRegisters * 4 + word_of_nat na * 4 + 4 = [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4
 4. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> kernel_all_global_addresses.frameRegisters.[unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na)] = register_from_H (?reg6880 reply na y)
 5. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4) 2
 6. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (?reg6880 reply na y)) s) = {(reply ! (unat n_msgRegisters + na), s)}
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
A total of 36 subgoals... proof (prove)
goal (35 subgoals):
 1. \<And>reply na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters; reply ! (unat n_msgRegisters + na) = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> Suc (unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na + 1)) \<le> 2 ^ (msg_align_bits - 2)
 2. \<And>reply na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters; reply ! (unat n_msgRegisters + na) = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> UCAST(32 signed \<rightarrow> 32) n_msgRegisters * 4 + word_of_nat na * 4 + 4 = [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4
 3. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> kernel_all_global_addresses.frameRegisters.[unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na)] = register_from_H (?reg6880 reply na y)
 4. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4) 2
 5. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (?reg6880 reply na y)) s) = {(reply ! (unat n_msgRegisters + na), s)}
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
A total of 35 subgoals... proof (prove)
goal (35 subgoals):
 1. \<And>reply na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; 4 < n; 4 < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = 4 + word_of_nat na; na + 4 < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na < 116; na + 4 < unat n_frameRegisters; reply ! (4 + na) = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> unat (5 + word_of_nat na) \<le> 127
 2. \<And>reply na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters; reply ! (unat n_msgRegisters + na) = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> UCAST(32 signed \<rightarrow> 32) n_msgRegisters * 4 + word_of_nat na * 4 + 4 = [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4
 3. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> kernel_all_global_addresses.frameRegisters.[unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na)] = register_from_H (?reg6880 reply na y)
 4. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4) 2
 5. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (?reg6880 reply na y)) s) = {(reply ! (unat n_msgRegisters + na), s)}
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
A total of 35 subgoals... proof (prove)
goal (34 subgoals):
 1. \<And>reply na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters; reply ! (unat n_msgRegisters + na) = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> UCAST(32 signed \<rightarrow> 32) n_msgRegisters * 4 + word_of_nat na * 4 + 4 = [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4
 2. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> kernel_all_global_addresses.frameRegisters.[unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na)] = register_from_H (?reg6880 reply na y)
 3. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4) 2
 4. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (?reg6880 reply na y)) s) = {(reply ! (unat n_msgRegisters + na), s)}
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
A total of 34 subgoals... proof (prove)
goal (33 subgoals):
 1. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> kernel_all_global_addresses.frameRegisters.[unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na)] = register_from_H (?reg6880 reply na y)
 2. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4) 2
 3. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (?reg6880 reply na y)) s) = {(reply ! (unat n_msgRegisters + na), s)}
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
A total of 33 subgoals... proof (prove)
goal (33 subgoals):
 1. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na) < length TCB_H.frameRegisters
 2. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4) 2
 3. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (TCB_H.frameRegisters ! unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na))) s) = {(reply ! (unat n_msgRegisters + na), s)}
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
A total of 33 subgoals... proof (prove)
goal (33 subgoals):
 1. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na) < unat n_frameRegisters
 2. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4) 2
 3. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (TCB_H.frameRegisters ! unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na))) s) = {(reply ! (unat n_msgRegisters + na), s)}
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
A total of 33 subgoals... proof (prove)
goal (34 subgoals):
 1. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters) + unat (word_of_nat na) < 2 ^ LENGTH(32)
 2. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters) + unat (word_of_nat na) < unat n_frameRegisters
 3. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4) 2
 4. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (TCB_H.frameRegisters ! unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na))) s) = {(reply ! (unat n_msgRegisters + na), s)}
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
A total of 34 subgoals... proof (prove)
goal (33 subgoals):
 1. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters) + unat (word_of_nat na) < unat n_frameRegisters
 2. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4) 2
 3. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (TCB_H.frameRegisters ! unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na))) s) = {(reply ! (unat n_msgRegisters + na), s)}
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
A total of 33 subgoals... proof (prove)
goal (32 subgoals):
 1. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4) 2
 2. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (TCB_H.frameRegisters ! unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na))) s) = {(reply ! (unat n_msgRegisters + na), s)}
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
A total of 32 subgoals... proof (prove)
goal (32 subgoals):
 1. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters; is_aligned y msg_align_bits; typ_at' UserDataT (y && ~~ mask pageBits) s\<rbrakk> \<Longrightarrow> is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4) 2
 2. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (TCB_H.frameRegisters ! unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na))) s) = {(reply ! (unat n_msgRegisters + na), s)}
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
A total of 32 subgoals... proof (prove)
goal (33 subgoals):
 1. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters; typ_at' UserDataT (y && ~~ mask pageBits) s\<rbrakk> \<Longrightarrow> is_aligned ([1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! na * 4) 2
 2. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters; typ_at' UserDataT (y && ~~ mask pageBits) s\<rbrakk> \<Longrightarrow> 2 \<le> msg_align_bits
 3. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (TCB_H.frameRegisters ! unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na))) s) = {(reply ! (unat n_msgRegisters + na), s)}
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
A total of 33 subgoals... proof (prove)
goal (32 subgoals):
 1. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters; typ_at' UserDataT (y && ~~ mask pageBits) s\<rbrakk> \<Longrightarrow> 2 \<le> msg_align_bits
 2. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (TCB_H.frameRegisters ! unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na))) s) = {(reply ! (unat n_msgRegisters + na), s)}
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
A total of 32 subgoals... proof (prove)
goal (31 subgoals):
 1. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (TCB_H.frameRegisters ! unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na))) s) = {(reply ! (unat n_msgRegisters + na), s)}
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
A total of 31 subgoals... proof (prove)
goal (31 subgoals):
 1. \<And>reply na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters\<rbrakk> \<Longrightarrow> fst (gets ((\<lambda>uc. uc (TCB_H.frameRegisters ! unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na))) \<circ> asUser_fetch target) s) = {(reply ! (unat n_msgRegisters + na), s)}
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
A total of 31 subgoals... proof (prove)
goal (31 subgoals):
 1. \<And>na y s s' obj. \<lbrakk>target \<noteq> thread; isCall; min (unat n_frameRegisters) (unat n) + min (unat n_gpRegisters) (unat n - unat n_frameRegisters) = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); y \<noteq> 0; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < n; UCAST(32 signed \<rightarrow> 32) n_msgRegisters < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; (s, s') \<in> rf_sr; i_' s' = UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na; na + unat n_msgRegisters < unat n; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + unat n_msgRegisters < unat n_frameRegisters; ksPSpace s target = Some (KOTCB obj); is_aligned target (objBitsKO (KOTCB obj)); ps_clear target (objBitsKO (KOTCB obj)) s\<rbrakk> \<Longrightarrow> atcbContextGet (tcbArch obj) (TCB_H.frameRegisters ! unat (UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat na)) = atcbContextGet (tcbArch obj) (TCB_H.frameRegisters ! (unat n_msgRegisters + na))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
A total of 31 subgoals... proof (prove)
goal (31 subgoals):
 1. \<And>na y s s' obj. \<lbrakk>target \<noteq> thread; isCall; min 10 (unat n) + min (unat n_gpRegisters) (unat n - 10) = min (unat n) (10 + unat n_gpRegisters); y \<noteq> 0; 4 < n; (s, s') \<in> rf_sr; i_' s' = 4 + word_of_nat na; na + 4 < unat n; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na < 6; ksPSpace s target = Some (KOTCB obj); is_aligned target (objBitsKO (KOTCB obj)); ps_clear target (objBitsKO (KOTCB obj)) s\<rbrakk> \<Longrightarrow> atcbContextGet (tcbArch obj) (TCB_H.frameRegisters ! unat (4 + word_of_nat na)) = atcbContextGet (tcbArch obj) (TCB_H.frameRegisters ! (4 + na))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
A total of 31 subgoals... proof (prove)
goal (32 subgoals):
 1. \<And>na y s s' obj. \<lbrakk>target \<noteq> thread; isCall; min 10 (unat n) + min (unat n_gpRegisters) (unat n - 10) = min (unat n) (10 + unat n_gpRegisters); y \<noteq> 0; 4 < n; (s, s') \<in> rf_sr; i_' s' = 4 + word_of_nat na; na + 4 < unat n; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na < 6; ksPSpace s target = Some (KOTCB obj); is_aligned target (objBitsKO (KOTCB obj)); ps_clear target (objBitsKO (KOTCB obj)) s\<rbrakk> \<Longrightarrow> unat 4 + unat (word_of_nat na) < 2 ^ LENGTH(32)
 2. \<And>na y s s' obj. \<lbrakk>target \<noteq> thread; isCall; min 10 (unat n) + min (unat n_gpRegisters) (unat n - 10) = min (unat n) (10 + unat n_gpRegisters); y \<noteq> 0; 4 < n; (s, s') \<in> rf_sr; i_' s' = 4 + word_of_nat na; na + 4 < unat n; valid_ipc_buffer_ptr' y s; valid_pspace' s; na + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na < 6; ksPSpace s target = Some (KOTCB obj); is_aligned target (objBitsKO (KOTCB obj)); ps_clear target (objBitsKO (KOTCB obj)) s\<rbrakk> \<Longrightarrow> atcbContextGet (tcbArch obj) (TCB_H.frameRegisters ! (unat 4 + unat (word_of_nat na))) = atcbContextGet (tcbArch obj) (TCB_H.frameRegisters ! (4 + na))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))))
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
A total of 32 subgoals... proof (prove)
goal (30 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread e reply state destIPCBuffer ipcBuffer rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (nb < UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat (min (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) - unat n_msgRegisters) (min (unat n_frameRegisters - unat n_msgRegisters) (unat n))))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
A total of 30 subgoals... proof (prove)
goal (30 subgoals):
 1. \<And>reply na y. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); option_to_ptr (Some y) \<noteq> NULL; (na < n \<and> na < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) = (\<not> na < UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat (min (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + (Suc (unat msgMaxLength) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))) - unat n_msgRegisters) (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)))); word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + (Suc (unat msgMaxLength) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))))) < n; word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + (Suc (unat msgMaxLength) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> y = 0
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
A total of 30 subgoals... proof (prove)
goal (30 subgoals):
 1. \<And>reply na y. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) 19; option_to_ptr (Some y) \<noteq> NULL; (na < n \<and> na < 0xA) = (\<not> na < 4 + word_of_nat (min (min (unat n) 19 - 4) (min 6 (unat n)))); word_of_nat (min 4 (min (unat n) 19)) < n; word_of_nat (min 4 (min (unat n) 19)) < 0xA\<rbrakk> \<Longrightarrow> y = 0
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
A total of 30 subgoals... proof (prove)
goal (30 subgoals):
 1. \<And>reply na y. \<lbrakk>target \<noteq> thread; isCall; length reply = (if unat n \<le> 19 then unat n else 19); option_to_ptr (Some y) \<noteq> NULL; (unat na < unat n \<and> unat na < 10) = (\<not> unat na < unat (4 + word_of_nat (if (if unat n \<le> 19 then unat n else 19) - 4 \<le> (if 6 \<le> unat n then 6 else unat n) then (if unat n \<le> 19 then unat n else 19) - 4 else if 6 \<le> unat n then 6 else unat n))); unat (word_of_nat (if 4 \<le> (if unat n \<le> 19 then unat n else 19) then 4 else if unat n \<le> 19 then unat n else 19)) < unat n; unat (word_of_nat (if 4 \<le> (if unat n \<le> 19 then unat n else 19) then 4 else if unat n \<le> 19 then unat n else 19)) < 10\<rbrakk> \<Longrightarrow> y = 0
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
A total of 30 subgoals... proof (prove)
goal (29 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>aa. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target aa \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) aa \<and> valid_pspace' aa) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> ?R6840 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a aa)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
A total of 29 subgoals... proof (prove)
goal (29 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a s. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> {s} \<subseteq> {sa. i_' sa < 0xA \<longrightarrow> kernel_all_global_addresses.frameRegisters.[unat (i_' sa)] < SCAST(32 signed \<rightarrow> 32) 0x14 \<longrightarrow> sa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr target \<longrightarrow> i_' sa + 1 = 0 \<or> array_assertion ipcBuffer (unat (i_' sa + 1)) (hrs_htd (t_hrs_' (globals sa))) \<longrightarrow> sa \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' sa + 1)) \<longrightarrow> i_' sa + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (i_' sa + 1))) (hrs_htd (t_hrs_' (globals sa))) \<longrightarrow> i_' sa = i_' s}
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>aa. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target aa \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) aa \<and> valid_pspace' aa) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> ?R6840 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a aa)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
A total of 29 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; Suc nb < length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) (snd (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>aa. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target aa \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) aa \<and> valid_pspace' aa) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> ?R6840 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a aa)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a aa. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> aa < na \<and> aa < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> aa < na \<and> aa < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> ?T6842 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a aa)})
A total of 28 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) < 2 ^ word_bits
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>aa. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target aa \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) aa \<and> valid_pspace' aa) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> ?R6840 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a aa)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a aa. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> aa < na \<and> aa < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> aa < na \<and> aa < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> ?T6842 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a aa)})
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>reply y. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); option_to_ptr (Some y) \<noteq> NULL; \<not> unat n_msgRegisters + min (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + (Suc (unat msgMaxLength) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))) - unat n_msgRegisters) (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) < 2 ^ word_bits; word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + (Suc (unat msgMaxLength) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))))) < n; word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + (Suc (unat msgMaxLength) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> y = 0
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>aa. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target aa \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) aa \<and> valid_pspace' aa) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> ?R6840 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a aa)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a aa. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> aa < na \<and> aa < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> aa < na \<and> aa < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> ?T6842 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a aa)})
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
A total of 27 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a x y. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); (\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))\<rbrakk> \<Longrightarrow> unat (i_' y) = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>aa. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target aa \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) aa \<and> valid_pspace' aa) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> ?R6840 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a aa)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a aa. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> aa < na \<and> aa < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> aa < na \<and> aa < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> ?T6842 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a aa)})
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>reply y x2. \<lbrakk>x2 \<noteq> 0; option_to_ptr (Some x2) \<noteq> NULL; i_' y = 4 + word_of_nat (min (min (unat n) 19 - 4) (min 6 (unat n))); target \<noteq> thread; isCall; length reply = min (unat n) 19; word_of_nat (min 4 (min (unat n) 19)) < n; word_of_nat (min 4 (min (unat n) 19)) < 0xA\<rbrakk> \<Longrightarrow> unat (4 + word_of_nat (min (min (unat n) 19 - 4) (min 6 (unat n)))) = min (unat n) 10
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>aa. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target aa \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) aa \<and> valid_pspace' aa) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> ?R6840 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a aa)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a aa. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> aa < na \<and> aa < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> aa < na \<and> aa < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> ?T6842 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a aa)})
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>reply y x2. \<lbrakk>i_' y = 0xA; target \<noteq> thread; isCall; unat n \<le> 19; length reply = unat n; 4 < n; x2 \<noteq> 0; option_to_ptr (Some x2) \<noteq> NULL; 6 \<le> unat n; \<not> unat n - 4 \<le> 6\<rbrakk> \<Longrightarrow> unat n \<le> 10 \<longrightarrow> unat n = 10
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>aa. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target aa \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) aa \<and> valid_pspace' aa) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> ?R6840 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a aa)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a aa. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> aa < na \<and> aa < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> aa < na \<and> aa < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> ?T6842 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a aa)})
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
A total of 26 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>aa. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target aa \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) aa \<and> valid_pspace' aa) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> ?R6840 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a aa)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a aa. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> aa < na \<and> aa < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> aa < na \<and> aa < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> ?T6842 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a aa)})
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); rv'a < n \<longrightarrow> destIPCBuffer = None \<or> \<not> rv'a < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) = rv'a\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?R6840 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()) (?T6842 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc () rv'a) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>aa. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target aa \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) aa \<and> valid_pspace' aa) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> ?R6840 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a aa)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a aa. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> aa < na \<and> aa < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> aa < na \<and> aa < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> ?T6842 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a aa)})
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); rv'a < n \<longrightarrow> destIPCBuffer = None \<or> \<not> rv'a < SCAST(32 signed \<rightarrow> 32) n_frameRegisters; word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) = rv'a\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = rv'a\<rbrace> [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<longrightarrow> destIPCBuffer = None \<or> \<not> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrace> [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
A total of 25 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); \<not> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrace> [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 2. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); destIPCBuffer = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrace> [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 3. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); \<not> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrace> [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); unat n \<le> unat (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrace> [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 2. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); destIPCBuffer = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrace> [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 3. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); \<not> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrace> [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
A total of 27 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) < 2 ^ word_bits
 2. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); unat n \<le> min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrace> [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 3. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); destIPCBuffer = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrace> [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 4. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); \<not> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrace> [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
A total of 28 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); unat n \<le> min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrace> [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 2. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); destIPCBuffer = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrace> [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 3. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); \<not> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrace> [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = unat n; destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); unat n \<le> unat n_msgRegisters; unat n \<le> unat n_frameRegisters + unat n_gpRegisters\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = n\<rbrace> [] (return ()) SKIP
 2. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); destIPCBuffer = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrace> [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 3. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); \<not> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrace> [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>reply destIPCBuffer s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = unat n; destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); unat n \<le> unat n_msgRegisters; unat n \<le> unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; True; s' \<in> \<lbrace>\<acute>i = n\<rbrace>\<rbrakk> \<Longrightarrow> True \<and> s' \<in> UNIV \<inter> \<lbrace>unat \<acute>i = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrace>
 2. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); destIPCBuffer = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrace> [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 3. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); \<not> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrace> [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>reply destIPCBuffer s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = unat n; destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); unat n \<le> 4; (s, s') \<in> rf_sr; i_' s' = n\<rbrakk> \<Longrightarrow> unat n = min (unat n) (case destIPCBuffer of None \<Rightarrow> 4 | Some a \<Rightarrow> 10)
 2. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); destIPCBuffer = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrace> [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 3. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); \<not> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrace> [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
A total of 27 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); destIPCBuffer = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrace> [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 2. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); \<not> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrace> [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); option_to_ptr None = NULL; destIPCBuffer = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters))\<rbrace> [] (return ()) SKIP
 2. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); \<not> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrace> [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>reply destIPCBuffer s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); option_to_ptr None = NULL; destIPCBuffer = None; (s, s') \<in> rf_sr; True; s' \<in> \<lbrace>\<acute>i = word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters))\<rbrace>\<rbrakk> \<Longrightarrow> True \<and> s' \<in> UNIV \<inter> \<lbrace>unat \<acute>i = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrace>
 2. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); \<not> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrace> [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>reply destIPCBuffer s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) 19; option_to_ptr None = NULL; destIPCBuffer = None; (s, s') \<in> rf_sr; i_' s' = word_of_nat (min (min (unat n) 19) 4)\<rbrakk> \<Longrightarrow> unat (word_of_nat (min (min (unat n) 19) 4)) = min (unat n) 4
 2. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); \<not> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrace> [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
A total of 26 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); \<not> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrace> [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); \<not> unat (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) < unat (SCAST(32 signed \<rightarrow> 32) n_frameRegisters)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrace> [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); unat (SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<le> unat (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrace> [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
A total of 25 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) < 2 ^ word_bits
 2. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); unat (SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<le> min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrace> [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
A total of 26 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); unat (SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<le> min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrace> [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) SKIP
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>reply destIPCBuffer. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) 19; destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); 10 \<le> unat n_msgRegisters \<and> 10 \<le> unat n \<and> 10 \<le> unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])\<rbrakk> \<Longrightarrow> ccorres (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>_. True) \<lbrace>\<acute>i = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) 19) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrace> [] (return ()) SKIP
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>reply destIPCBuffer s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) 19; destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); 10 \<le> unat n_msgRegisters \<and> 10 \<le> unat n \<and> 10 \<le> unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]); (s, s') \<in> rf_sr; True; s' \<in> \<lbrace>\<acute>i = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) 19) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))\<rbrace>\<rbrakk> \<Longrightarrow> True \<and> s' \<in> UNIV \<inter> \<lbrace>unat \<acute>i = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
A total of 25 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'b t t' (\<acute>j :== \<acute>i;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b)
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
A total of 24 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (\<acute>j :== rv'b;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (?Q'6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
A total of 23 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?G'9220 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> ?G'9220 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b})
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
A total of 23 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?G'9546 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> ?G'9546 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b}})
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
A total of 23 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?G'9546 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters THEN
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1;;
While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
ELSE
  IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
FI)
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> ?G'9546 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b}})
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
A total of 23 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?R'9680 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [SKIP] (do rv <- mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))));
_ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI;;
(\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q6828 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> ?R'9680 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
A total of 23 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres (?r'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) (?xf'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) (?P9683 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?R'9680 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) (IF (\<exists>y. destIPCBuffer = Some y) \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI)
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); ?r'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) (?xf'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. ?P9683 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> ?R'9680 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ccorres (?r'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) (?xf'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) (?P9683 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?G'9690 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) (IF (\<exists>y. destIPCBuffer = Some y) \<and> rv'c < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> rv'c + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI)
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); ?r'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) (?xf'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. ?P9683 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> ?G'9690 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b (i_' s)} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0\<rbrakk> \<Longrightarrow> ccorres (?r'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) (?xf'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) (?P9683 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv) (?G'19481 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) (IF (\<exists>y. destIPCBuffer = Some y) \<and> i_c < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> i_c + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI)
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); ?r'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) (?xf'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. ?P9683 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> ?G'19481 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b (i_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0\<rbrakk> \<Longrightarrow> ccorres (?r'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) (?xf'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) (?P9683 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?G'19481 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) (IF (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI)
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); ?r'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) (?xf'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. ?P9683 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> ?G'19481 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b (i_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
A total of 27 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> ccorres (?r'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) (?xf'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) (?Q19492 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?S19499 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) (While \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n)\<rbrakk> \<Longrightarrow> ccorres (?r'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) (?xf'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); ?r'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) (?xf'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> ?Q19492 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> ?R19491 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv a)) and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> ?S19499 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b (i_' s)) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> ?T19497 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b (i_' s))} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
A total of 28 subgoals... proof (prove)
goal (32 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdca rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>na<length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))). ccorres dc xfdc (\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s) \<lbrace>\<acute>i = word_of_nat 0 + word_of_nat na\<rbrace> [] (storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! na)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! na))) (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> (nb < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> nb + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n) = (nb < word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> 0 + length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) < 2 ^ word_bits
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b)
A total of 32 subgoals... proof (prove)
goal (32 subgoals):
 1. \<And>reply rv'b na y. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); option_to_ptr (Some y) \<noteq> NULL; unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>s. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' y s \<and> valid_pspace' s) \<lbrace>\<acute>i = word_of_nat na\<rbrace> [] (storeWordUser (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4) (reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na))) (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion (option_to_ptr (Some y)) (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (option_to_ptr (Some y) +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion (option_to_ptr (Some y)) (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (option_to_ptr (Some y) +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> (nb < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> nb + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n) = (nb < word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> 0 + length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) < 2 ^ word_bits
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b)
A total of 32 subgoals... proof (prove)
goal (33 subgoals):
 1. \<And>reply rv'b na y. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); option_to_ptr (Some y) \<noteq> NULL; unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q19530 reply rv'b na y) (?Q'19530 reply rv'b na y) [] (storeWordUser (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4) (reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na))) (Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion (option_to_ptr (Some y)) (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (option_to_ptr (Some y) +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion (option_to_ptr (Some y)) (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (option_to_ptr (Some y) +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))))
 2. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); option_to_ptr (Some y) \<noteq> NULL; unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' y s \<and> valid_pspace' s; s' \<in> \<lbrace>\<acute>i = word_of_nat na\<rbrace>\<rbrakk> \<Longrightarrow> ?Q19530 reply rv'b na y s \<and> s' \<in> ?Q'19530 reply rv'b na y
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> (nb < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> nb + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n) = (nb < word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> 0 + length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) < 2 ^ word_bits
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
A total of 33 subgoals... proof (prove)
goal (35 subgoals):
 1. \<And>reply rv'b na y rv ret__unsigned_long. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); option_to_ptr (Some y) \<noteq> NULL; unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; ?rv19539 reply rv'b na y = ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q19538 reply rv'b na y rv) (?Q'19538 reply rv'b na y rv ret__unsigned_long) [] (storeWordUser (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4) (reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na))) (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion (option_to_ptr (Some y)) (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (option_to_ptr (Some y) +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion (option_to_ptr (Some y)) (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (option_to_ptr (Some y) +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) ret__unsigned_long))))))
 2. \<And>reply rv'b na y. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); option_to_ptr (Some y) \<noteq> NULL; unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R19538 reply rv'b na y\<rbrace> return () \<lbrace>?Q19538 reply rv'b na y\<rbrace>
 3. \<And>reply rv'b na y. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); option_to_ptr (Some y) \<noteq> NULL; unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19538 reply rv'b na y) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]) {s. \<forall>rv. ?rv19539 reply rv'b na y = ret__unsigned_long_' s \<longrightarrow> s \<in> ?Q'19538 reply rv'b na y rv (ret__unsigned_long_' s)}
 4. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); option_to_ptr (Some y) \<noteq> NULL; unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' y s \<and> valid_pspace' s; s' \<in> \<lbrace>\<acute>i = word_of_nat na\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. True \<and> tcb_at' target s \<and> (True \<and> tcb_at' target s \<longrightarrow> fst (asUser target (getRegister (?reg19539 reply rv'b na y)) s) = {(?rv19539 reply rv'b na y, s)})) and ?R19538 reply rv'b na y) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.gpRegisters.[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr target) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr target\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (?reg19539 reply rv'b na y)\<rbrace>} \<inter> ?R'19538 reply rv'b na y \<inter> \<lbrace>\<acute>i < 9\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> (nb < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> nb + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n) = (nb < word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> 0 + length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) < 2 ^ word_bits
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
A total of 35 subgoals... proof (prove)
goal (35 subgoals):
 1. \<And>reply rv'b na y rv ret__unsigned_long. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); option_to_ptr (Some y) \<noteq> NULL; unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; ?rv19539 reply rv'b na y = ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A19602 reply rv'b na y rv) (?C'19601 reply rv'b na y rv ret__unsigned_long) [] (storeWordUser (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4) (reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na))) (Guard C_Guard {s. s \<Turnstile>\<^sub>c (option_to_ptr (Some y) +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (option_to_ptr (Some y) +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) ret__unsigned_long))))
 2. \<And>reply rv'b na y. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); option_to_ptr (Some y) \<noteq> NULL; unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R19538 reply rv'b na y\<rbrace> return () \<lbrace>\<lambda>rv. ?A19602 reply rv'b na y rv and valid_ipc_buffer_ptr' (ptr_val (option_to_ptr (Some y))) and valid_ipc_buffer_ptr' (ptr_val (option_to_ptr (Some y)))\<rbrace>
 3. \<And>reply rv'b na y. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); option_to_ptr (Some y) \<noteq> NULL; unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19538 reply rv'b na y) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]) {s. \<forall>rv. ?rv19539 reply rv'b na y = ret__unsigned_long_' s \<longrightarrow> s \<in> ?C'19601 reply rv'b na y rv (ret__unsigned_long_' s) \<inter> \<lbrace>Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 \<noteq> 0 \<longrightarrow> Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<noteq> 0)\<rbrace> \<inter> \<lbrace>unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 \<noteq> 0 \<longrightarrow> unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1) \<noteq> 0)\<rbrace>}
 4. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); option_to_ptr (Some y) \<noteq> NULL; unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' y s \<and> valid_pspace' s; s' \<in> \<lbrace>\<acute>i = word_of_nat na\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. True \<and> tcb_at' target s \<and> (True \<and> tcb_at' target s \<longrightarrow> fst (asUser target (getRegister (?reg19539 reply rv'b na y)) s) = {(?rv19539 reply rv'b na y, s)})) and ?R19538 reply rv'b na y) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.gpRegisters.[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr target) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr target\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (?reg19539 reply rv'b na y)\<rbrace>} \<inter> ?R'19538 reply rv'b na y \<inter> \<lbrace>\<acute>i < 9\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> (nb < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> nb + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n) = (nb < word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> 0 + length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) < 2 ^ word_bits
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
A total of 35 subgoals... proof (prove)
goal (34 subgoals):
 1. \<And>reply rv'b na y. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); option_to_ptr (Some y) \<noteq> NULL; unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R19538 reply rv'b na y\<rbrace> return () \<lbrace>\<lambda>rv. valid_pspace' and (\<lambda>_. is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4) 2) and valid_ipc_buffer_ptr' (ptr_val (option_to_ptr (Some y))) and valid_ipc_buffer_ptr' (ptr_val (option_to_ptr (Some y)))\<rbrace>
 2. \<And>reply rv'b na y. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); option_to_ptr (Some y) \<noteq> NULL; unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19538 reply rv'b na y) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]) {s. \<forall>rv. ?rv19539 reply rv'b na y = ret__unsigned_long_' s \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>option_to_ptr (Some y) +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1) = PTR(32 word) (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4)\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned_long = reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na)\<rbrace> \<inter> \<lbrace>Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 \<noteq> 0 \<longrightarrow> Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<noteq> 0)\<rbrace> \<inter> \<lbrace>unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 \<noteq> 0 \<longrightarrow> unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1) \<noteq> 0)\<rbrace>}
 3. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); option_to_ptr (Some y) \<noteq> NULL; unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' y s \<and> valid_pspace' s; s' \<in> \<lbrace>\<acute>i = word_of_nat na\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. True \<and> tcb_at' target s \<and> (True \<and> tcb_at' target s \<longrightarrow> fst (asUser target (getRegister (?reg19539 reply rv'b na y)) s) = {(?rv19539 reply rv'b na y, s)})) and ?R19538 reply rv'b na y) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.gpRegisters.[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr target) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr target\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (?reg19539 reply rv'b na y)\<rbrace>} \<inter> ?R'19538 reply rv'b na y \<inter> \<lbrace>\<acute>i < 9\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> (nb < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> nb + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n) = (nb < word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> 0 + length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) < 2 ^ word_bits
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
A total of 34 subgoals... proof (prove)
goal (33 subgoals):
 1. \<And>reply rv'b na y. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); option_to_ptr (Some y) \<noteq> NULL; unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'19538 reply rv'b na y) \<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]) {s. \<forall>rv. ?rv19539 reply rv'b na y = ret__unsigned_long_' s \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>option_to_ptr (Some y) +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1) = PTR(32 word) (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4)\<rbrace> \<inter> \<lbrace>\<^bsup>s\<^esup>ret__unsigned_long = reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na)\<rbrace> \<inter> \<lbrace>Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 \<noteq> 0 \<longrightarrow> Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<noteq> 0)\<rbrace> \<inter> \<lbrace>unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 \<noteq> 0 \<longrightarrow> unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1) \<noteq> 0)\<rbrace>}
 2. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); option_to_ptr (Some y) \<noteq> NULL; unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' y s \<and> valid_pspace' s; s' \<in> \<lbrace>\<acute>i = word_of_nat na\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. True \<and> tcb_at' target s \<and> (True \<and> tcb_at' target s \<longrightarrow> fst (asUser target (getRegister (?reg19539 reply rv'b na y)) s) = {(?rv19539 reply rv'b na y, s)})) and (valid_pspace' and (\<lambda>_. is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4) 2) and valid_ipc_buffer_ptr' (ptr_val (option_to_ptr (Some y))) and valid_ipc_buffer_ptr' (ptr_val (option_to_ptr (Some y))))) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.gpRegisters.[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr target) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr target\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (?reg19539 reply rv'b na y)\<rbrace>} \<inter> ?R'19538 reply rv'b na y \<inter> \<lbrace>\<acute>i < 9\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> (nb < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> nb + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n) = (nb < word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> 0 + length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) < 2 ^ word_bits
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
A total of 33 subgoals... proof (prove)
goal (32 subgoals):
 1. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); option_to_ptr (Some y) \<noteq> NULL; unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' y s \<and> valid_pspace' s; s' \<in> \<lbrace>\<acute>i = word_of_nat na\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>s. True \<and> tcb_at' target s \<and> (True \<and> tcb_at' target s \<longrightarrow> fst (asUser target (getRegister (?reg19539 reply rv'b na y)) s) = {(?rv19539 reply rv'b na y, s)})) and (valid_pspace' and (\<lambda>_. is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4) 2) and valid_ipc_buffer_ptr' (ptr_val (option_to_ptr (Some y))) and valid_ipc_buffer_ptr' (ptr_val (option_to_ptr (Some y))))) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.gpRegisters.[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr target) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr target\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (?reg19539 reply rv'b na y)\<rbrace>} \<inter> \<lbrace>\<forall>t. ?rv19539 reply rv'b na y = \<^bsup>t\<^esup>ret__unsigned_long \<longrightarrow> option_to_ptr (Some y) +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1) = PTR(32 word) (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4) \<and> \<^bsup>t\<^esup>ret__unsigned_long = reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na) \<and> Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 \<noteq> 0 \<longrightarrow> Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<noteq> 0) \<and> unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 \<noteq> 0 \<longrightarrow> unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>\<acute>i < 9\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> (nb < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> nb + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n) = (nb < word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> 0 + length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) < 2 ^ word_bits
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b)
A total of 32 subgoals... proof (prove)
goal (32 subgoals):
 1. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (?reg19539 reply rv'b na y)) s) = {(?rv19539 reply rv'b na y, s)} \<and> is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4) 2 \<and> kernel_all_global_addresses.gpRegisters.[unat (word_of_nat na)] = register_from_H (?reg19539 reply rv'b na y) \<and> (\<forall>t. ?rv19539 reply rv'b na y = ret__unsigned_long_' t \<longrightarrow> word_of_nat na * 4 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters * 4 + 4 = [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4 \<and> ret__unsigned_long_' t = reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na) \<and> Suc (unat (word_of_nat na + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> unat (word_of_nat na + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1) \<le> 2 ^ (msg_align_bits - 2)) \<and> word_of_nat na < 9
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> (nb < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> nb + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n) = (nb < word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> 0 + length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) < 2 ^ word_bits
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b)
A total of 32 subgoals... proof (prove)
goal (39 subgoals):
 1. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> word_of_nat na < 9
 2. \<And>reply rv'b na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; ?rv19539 reply rv'b na y = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> unat (word_of_nat na + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1) \<le> 2 ^ (msg_align_bits - 2)
 3. \<And>reply rv'b na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; ?rv19539 reply rv'b na y = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> Suc (unat (word_of_nat na + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<le> 2 ^ (msg_align_bits - 2)
 4. \<And>reply rv'b na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; ?rv19539 reply rv'b na y = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> ret__unsigned_long_' t = reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na)
 5. \<And>reply rv'b na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; ?rv19539 reply rv'b na y = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> word_of_nat na * 4 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters * 4 + 4 = [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4
 6. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> kernel_all_global_addresses.gpRegisters.[unat (word_of_nat na)] = register_from_H (?reg19539 reply rv'b na y)
 7. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4) 2
 8. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (?reg19539 reply rv'b na y)) s) = {(?rv19539 reply rv'b na y, s)}
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> (nb < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> nb + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n) = (nb < word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
A total of 39 subgoals... proof (prove)
goal (38 subgoals):
 1. \<And>reply rv'b na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; ?rv19539 reply rv'b na y = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> unat (word_of_nat na + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1) \<le> 2 ^ (msg_align_bits - 2)
 2. \<And>reply rv'b na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; ?rv19539 reply rv'b na y = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> Suc (unat (word_of_nat na + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<le> 2 ^ (msg_align_bits - 2)
 3. \<And>reply rv'b na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; ?rv19539 reply rv'b na y = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> ret__unsigned_long_' t = reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na)
 4. \<And>reply rv'b na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; ?rv19539 reply rv'b na y = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> word_of_nat na * 4 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters * 4 + 4 = [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4
 5. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> kernel_all_global_addresses.gpRegisters.[unat (word_of_nat na)] = register_from_H (?reg19539 reply rv'b na y)
 6. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4) 2
 7. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (?reg19539 reply rv'b na y)) s) = {(?rv19539 reply rv'b na y, s)}
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> (nb < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> nb + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n) = (nb < word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
A total of 38 subgoals... proof (prove)
goal (38 subgoals):
 1. \<And>reply rv'b na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; ?rv19539 reply rv'b na y = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> ret__unsigned_long_' t = reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na)
 2. \<And>reply rv'b na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; ?rv19539 reply rv'b na y = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> unat (word_of_nat na + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1) \<le> 2 ^ (msg_align_bits - 2)
 3. \<And>reply rv'b na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; ?rv19539 reply rv'b na y = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> Suc (unat (word_of_nat na + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<le> 2 ^ (msg_align_bits - 2)
 4. \<And>reply rv'b na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; ?rv19539 reply rv'b na y = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> word_of_nat na * 4 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters * 4 + 4 = [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4
 5. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> kernel_all_global_addresses.gpRegisters.[unat (word_of_nat na)] = register_from_H (?reg19539 reply rv'b na y)
 6. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4) 2
 7. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (?reg19539 reply rv'b na y)) s) = {(?rv19539 reply rv'b na y, s)}
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> (nb < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> nb + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n) = (nb < word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
A total of 38 subgoals... proof (prove)
goal (37 subgoals):
 1. \<And>reply rv'b na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na) = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> unat (word_of_nat na + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1) \<le> 2 ^ (msg_align_bits - 2)
 2. \<And>reply rv'b na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na) = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> Suc (unat (word_of_nat na + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<le> 2 ^ (msg_align_bits - 2)
 3. \<And>reply rv'b na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na) = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> word_of_nat na * 4 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters * 4 + 4 = [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4
 4. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> kernel_all_global_addresses.gpRegisters.[unat (word_of_nat na)] = register_from_H (?reg19539 reply rv'b na y)
 5. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4) 2
 6. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (?reg19539 reply rv'b na y)) s) = {(reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na), s)}
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> (nb < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> nb + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n) = (nb < word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> 0 + length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) < 2 ^ word_bits
A total of 37 subgoals... proof (prove)
goal (37 subgoals):
 1. \<And>reply rv'b na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (10 + unat n_gpRegisters); unat rv'b = 10; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; 0xA < n; y \<noteq> 0; na < 110; na + (min 6 (unat n) + 4) < unat n; na < unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; reply ! (10 + na) = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> unat (0xB + word_of_nat na) \<le> 128
 2. \<And>reply rv'b na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na) = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> Suc (unat (word_of_nat na + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<le> 2 ^ (msg_align_bits - 2)
 3. \<And>reply rv'b na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na) = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> word_of_nat na * 4 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters * 4 + 4 = [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4
 4. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> kernel_all_global_addresses.gpRegisters.[unat (word_of_nat na)] = register_from_H (?reg19539 reply rv'b na y)
 5. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4) 2
 6. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (?reg19539 reply rv'b na y)) s) = {(reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na), s)}
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> (nb < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> nb + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n) = (nb < word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> 0 + length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) < 2 ^ word_bits
A total of 37 subgoals... proof (prove)
goal (36 subgoals):
 1. \<And>reply rv'b na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na) = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> Suc (unat (word_of_nat na + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<le> 2 ^ (msg_align_bits - 2)
 2. \<And>reply rv'b na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na) = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> word_of_nat na * 4 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters * 4 + 4 = [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4
 3. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> kernel_all_global_addresses.gpRegisters.[unat (word_of_nat na)] = register_from_H (?reg19539 reply rv'b na y)
 4. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4) 2
 5. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (?reg19539 reply rv'b na y)) s) = {(reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na), s)}
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> (nb < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> nb + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n) = (nb < word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> 0 + length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) < 2 ^ word_bits
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
A total of 36 subgoals... proof (prove)
goal (36 subgoals):
 1. \<And>reply rv'b na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (10 + unat n_gpRegisters); unat rv'b = 10; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; 0xA < n; y \<noteq> 0; na < 110; na + (min 6 (unat n) + 4) < unat n; na < unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; reply ! (10 + na) = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> unat (0xB + word_of_nat na) \<le> 127
 2. \<And>reply rv'b na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na) = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> word_of_nat na * 4 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters * 4 + 4 = [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4
 3. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> kernel_all_global_addresses.gpRegisters.[unat (word_of_nat na)] = register_from_H (?reg19539 reply rv'b na y)
 4. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4) 2
 5. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (?reg19539 reply rv'b na y)) s) = {(reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na), s)}
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> (nb < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> nb + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n) = (nb < word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> 0 + length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) < 2 ^ word_bits
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
A total of 36 subgoals... proof (prove)
goal (35 subgoals):
 1. \<And>reply rv'b na y s s' t. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s; reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na) = ret__unsigned_long_' t\<rbrakk> \<Longrightarrow> word_of_nat na * 4 + SCAST(32 signed \<rightarrow> 32) n_frameRegisters * 4 + 4 = [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4
 2. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> kernel_all_global_addresses.gpRegisters.[unat (word_of_nat na)] = register_from_H (?reg19539 reply rv'b na y)
 3. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4) 2
 4. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (?reg19539 reply rv'b na y)) s) = {(reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na), s)}
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> (nb < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> nb + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n) = (nb < word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> 0 + length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) < 2 ^ word_bits
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
A total of 35 subgoals... proof (prove)
goal (34 subgoals):
 1. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> kernel_all_global_addresses.gpRegisters.[unat (word_of_nat na)] = register_from_H (?reg19539 reply rv'b na y)
 2. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4) 2
 3. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (?reg19539 reply rv'b na y)) s) = {(reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na), s)}
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> (nb < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> nb + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n) = (nb < word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> 0 + length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) < 2 ^ word_bits
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
A total of 34 subgoals... proof (prove)
goal (34 subgoals):
 1. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> unat (word_of_nat na) < length TCB_H.gpRegisters
 2. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4) 2
 3. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (TCB_H.gpRegisters ! unat (word_of_nat na))) s) = {(reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na), s)}
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> (nb < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> nb + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n) = (nb < word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> 0 + length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) < 2 ^ word_bits
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
A total of 34 subgoals... proof (prove)
goal (33 subgoals):
 1. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> is_aligned (y + [1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4) 2
 2. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (TCB_H.gpRegisters ! unat (word_of_nat na))) s) = {(reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na), s)}
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> (nb < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> nb + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n) = (nb < word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> 0 + length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) < 2 ^ word_bits
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
A total of 33 subgoals... proof (prove)
goal (34 subgoals):
 1. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_pspace' s; typ_at' UserDataT (y && ~~ mask pageBits) s\<rbrakk> \<Longrightarrow> is_aligned ([1 + word_of_nat (length TCB_H.msgRegisters) .e. msgMaxLength] ! (unat n_frameRegisters - unat n_msgRegisters + na) * 4) 2
 2. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_pspace' s; typ_at' UserDataT (y && ~~ mask pageBits) s\<rbrakk> \<Longrightarrow> 2 \<le> msg_align_bits
 3. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (TCB_H.gpRegisters ! unat (word_of_nat na))) s) = {(reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na), s)}
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> (nb < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> nb + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n) = (nb < word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> 0 + length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) < 2 ^ word_bits
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
A total of 34 subgoals... proof (prove)
goal (33 subgoals):
 1. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_pspace' s; typ_at' UserDataT (y && ~~ mask pageBits) s\<rbrakk> \<Longrightarrow> 2 \<le> msg_align_bits
 2. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (TCB_H.gpRegisters ! unat (word_of_nat na))) s) = {(reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na), s)}
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> (nb < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> nb + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n) = (nb < word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> 0 + length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) < 2 ^ word_bits
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
A total of 33 subgoals... proof (prove)
goal (32 subgoals):
 1. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> fst (asUser target (getRegister (TCB_H.gpRegisters ! unat (word_of_nat na))) s) = {(reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na), s)}
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> (nb < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> nb + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n) = (nb < word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> 0 + length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) < 2 ^ word_bits
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b)
A total of 32 subgoals... proof (prove)
goal (32 subgoals):
 1. \<And>reply rv'b na y s s'. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); unat rv'b = unat n_frameRegisters; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; y \<noteq> 0; na + (unat n_frameRegisters - unat n_msgRegisters) + unat (1 + word_of_nat (length TCB_H.msgRegisters)) < Suc (unat msgMaxLength); na + (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) < unat n; na + (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters) < unat n_frameRegisters + unat n_gpRegisters; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s; valid_ipc_buffer_ptr' y s; valid_pspace' s\<rbrakk> \<Longrightarrow> fst (gets ((\<lambda>uc. uc (TCB_H.gpRegisters ! unat (word_of_nat na))) \<circ> asUser_fetch target) s) = {(reply ! (unat n_frameRegisters - unat n_msgRegisters + unat n_msgRegisters + na), s)}
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> (nb < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> nb + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n) = (nb < word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> 0 + length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) < 2 ^ word_bits
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b)
A total of 32 subgoals... proof (prove)
goal (32 subgoals):
 1. \<And>rv'b na y s s' obj. \<lbrakk>target \<noteq> thread; isCall; 10 + min 9 (unat n - 10) = min (unat n) 19; unat rv'b = 10; 0xA < n; y \<noteq> 0; 5 + (na + unat (1 + word_of_nat (length TCB_H.msgRegisters))) < unat msgMaxLength; na + 10 < unat n; na < 9; (s, s') \<in> rf_sr; i_' s' = word_of_nat na; valid_ipc_buffer_ptr' y s; valid_pspace' s; ksPSpace s target = Some (KOTCB obj); is_aligned target (objBitsKO (KOTCB obj)); ps_clear target (objBitsKO (KOTCB obj)) s\<rbrakk> \<Longrightarrow> atcbContextGet (tcbArch obj) (TCB_H.gpRegisters ! unat (word_of_nat na)) = atcbContextGet (tcbArch obj) (TCB_H.gpRegisters ! na)
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> (nb < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> nb + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n) = (nb < word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> 0 + length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) < 2 ^ word_bits
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b)
A total of 32 subgoals... proof (prove)
goal (31 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> (nb < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> nb + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n) = (nb < word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> 0 + length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) < 2 ^ word_bits
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> ?R19491 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv a)) and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
A total of 31 subgoals... proof (prove)
goal (31 subgoals):
 1. \<And>reply rv'b na y. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); option_to_ptr (Some y) \<noteq> NULL; unat rv'b = min (unat n) (unat n_frameRegisters); (na < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> na + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n) = (\<not> na < word_of_nat (min (Suc (unat msgMaxLength) - (unat (1 + word_of_nat (length TCB_H.msgRegisters)) + min (unat n_frameRegisters - unat n_msgRegisters) (unat n))) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + (Suc (unat msgMaxLength) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))) - (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters)))); 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters; SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> y = 0
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> 0 + length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) < 2 ^ word_bits
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> ?R19491 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv a)) and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
A total of 31 subgoals... proof (prove)
goal (31 subgoals):
 1. \<And>reply rv'b na y. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) 19; option_to_ptr (Some y) \<noteq> NULL; unat rv'b = min (unat n) 10; (na < 9 \<and> na + 0xA < n) = (\<not> na < word_of_nat (min (unat n) 19 - (min 6 (unat n) + 4))); 0xA < n\<rbrakk> \<Longrightarrow> y = 0
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> 0 + length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) < 2 ^ word_bits
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> ?R19491 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv a)) and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
A total of 31 subgoals... proof (prove)
goal (31 subgoals):
 1. \<And>reply rv'b na y. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) 19; option_to_ptr (Some y) \<noteq> NULL; unat rv'b = 10; (unat na < 9 \<and> unat (na + 0xA) < unat n) = (\<not> unat na < min (unat n) 19 - 10); 10 < unat n\<rbrakk> \<Longrightarrow> y = 0
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> 0 + length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) < 2 ^ word_bits
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> ?R19491 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv a)) and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
A total of 31 subgoals... proof (prove)
goal (31 subgoals):
 1. \<And>reply rv'b na y. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) 19; option_to_ptr (Some y) \<noteq> NULL; unat rv'b = 10; (unat na < 9 \<and> unat na + 10 < unat n) = (\<not> unat na < min (unat n) 19 - 10); 10 < unat n\<rbrakk> \<Longrightarrow> y = 0
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> 0 + length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) < 2 ^ word_bits
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b)
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> ?R19491 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv a)) and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
A total of 31 subgoals... proof (prove)
goal (30 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> 0 + length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) < 2 ^ word_bits
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> ?R19491 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv a)) and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> ?T19497 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b (i_' s))} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
A total of 30 subgoals... proof (prove)
goal (30 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c s. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> {s} \<subseteq> {sa. i_' sa < 9 \<longrightarrow> kernel_all_global_addresses.gpRegisters.[unat (i_' sa)] < SCAST(32 signed \<rightarrow> 32) 0x14 \<longrightarrow> sa \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr target \<longrightarrow> i_' sa + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (unat (i_' sa + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd (t_hrs_' (globals sa))) \<longrightarrow> sa \<Turnstile>\<^sub>c (ipcBuffer +\<^sub>p uint (i_' sa + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<longrightarrow> i_' sa + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion ipcBuffer (Suc (unat (i_' sa + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd (t_hrs_' (globals sa))) \<longrightarrow> i_' sa = i_' s}
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> 0 + length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) < 2 ^ word_bits
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b)
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> ?R19491 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv a)) and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> ?T19497 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b (i_' s))} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
A total of 30 subgoals... proof (prove)
goal (29 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c nb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n; Suc nb < length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace> storeWordUser (fst (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) (snd (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) ! nb)) \<lbrace>\<lambda>_ s. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> 0 + length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) < 2 ^ word_bits
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b)
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> ?R19491 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv a)) and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> ?T19497 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b (i_' s))} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
A total of 29 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; (\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> 0 + length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))) < 2 ^ word_bits
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> ?R19491 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv a)) and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> ?T19497 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b (i_' s))} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
A total of 28 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> ?R19491 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv a)) and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> ?T19497 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b (i_' s))} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<longrightarrow> destIPCBuffer = None \<or> \<not> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> ?R19491 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv a)) and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> ?T19497 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b (i_' s))} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + 9); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + 9)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; destIPCBuffer = None \<or> \<not> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + 9)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + 9)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + 9)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> ?R19491 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv a)) and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> ?T19497 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b (i_' s))} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
A total of 27 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + 9); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + 9)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; destIPCBuffer = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + 9)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + 9)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + 9)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + 9); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + 9)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + 9)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + 9)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + 9)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> ?R19491 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv a)) and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> ?T19497 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b (i_' s))} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
A total of 28 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>rv' self reply xfdc rv'b. \<lbrakk>target \<noteq> thread; isCall; option_to_ptr None = NULL; length reply = min (unat n) (unat n_frameRegisters + 9); unat rv'b = min (unat n_frameRegisters) (min (unat n) (unat n_msgRegisters))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = 0) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart None NULL xfdc (word_of_nat (min (min (unat n) (unat n_frameRegisters + 9)) (unat n_msgRegisters))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart None NULL xfdc (word_of_nat (min (min (unat n) (unat n_frameRegisters + 9)) (unat n_msgRegisters))) () rv'b 0) [] (return ()) SKIP
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + 9); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + 9)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?R19491 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + 9)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) ()) (?T19497 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer xfdc (word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + 9)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))))) () rv'b 0) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + 9)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b)
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> ?R19491 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv a)) and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> ?T19497 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b (i_' s))} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
A total of 28 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + 9); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + 9)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_c = 0; \<not> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (\<lambda>a. True) (UNIV \<inter> \<lbrace>\<acute>i = 0\<rbrace>) [] (mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + 9)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) SKIP
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> True)) and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>)} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread e reply state destIPCBuffer ipcBuffer rv'a rv'b i_c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = unat n; rv'a = word_of_nat (min 4 (min (unat n) (4 + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters); i_c = 0; unat n \<le> 10\<rbrakk> \<Longrightarrow> ccorres (\<lambda>a b. b = 0) i_' (\<lambda>a. True) \<lbrace>\<acute>i = 0\<rbrace> [] (return ()) SKIP
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> True)) and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>)} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
A total of 27 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread e reply state destIPCBuffer ipcBuffer rv'a rv'b i_c s s'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = unat n; rv'a = word_of_nat (min 4 (min (unat n) (4 + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters); i_c = 0; unat n \<le> 10; (s, s') \<in> rf_sr; True; s' \<in> \<lbrace>\<acute>i = 0\<rbrace>\<rbrakk> \<Longrightarrow> True \<and> s' \<in> UNIV \<inter> \<lbrace>\<acute>i = 0\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b)
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> True)) and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>)} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
A total of 27 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c t t'. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'c t t' (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (?d'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rv'c)
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b)
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> True)) and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>)} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
A total of 26 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,rv'c + rv'b);;
(\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (?Q'9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> True)) and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>)} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))); seL4_MessageInfo_lift ret__struct_seL4_MessageInfo_C = \<lparr>label_CL = 0, capsUnwrapped_CL = 0, extraCaps_CL = 0, length_CL = rv'c + rv'b && mask 7\<rparr>\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?G'33544 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(ret__struct_seL4_MessageInfo_C);;
(CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (\<lambda>rva rv'c. {s. \<forall>v. seL4_MessageInfo_lift v = \<lparr>label_CL = label_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 20, capsUnwrapped_CL = capsUnwrapped_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 3, extraCaps_CL = extraCaps_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 2, length_CL = length_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 7\<rparr> \<longrightarrow> s\<lparr>ret__struct_seL4_MessageInfo_C_' := v\<rparr> \<in> ?G'33544 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c v})
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> True)) and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>)} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
A total of 25 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))); seL4_MessageInfo_lift ret__struct_seL4_MessageInfo_C = \<lparr>label_CL = 0, capsUnwrapped_CL = 0, extraCaps_CL = 0, length_CL = rv'c + rv'b && mask 7\<rparr>\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva) (?G'33544 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C) [SKIP] (do _ <- setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0);
r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long);;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>?Q9682 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (\<lambda>rva rv'c. {s. \<forall>v. seL4_MessageInfo_lift v = \<lparr>label_CL = label_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 20, capsUnwrapped_CL = capsUnwrapped_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 3, extraCaps_CL = extraCaps_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 2, length_CL = length_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 7\<rparr> \<longrightarrow> s\<lparr>ret__struct_seL4_MessageInfo_C_' := v\<rparr> \<in> ?G'33544 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c v})
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> True)) and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>)} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
A total of 25 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdca rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C uu_ xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))); seL4_MessageInfo_lift ret__struct_seL4_MessageInfo_C = \<lparr>label_CL = 0, capsUnwrapped_CL = 0, extraCaps_CL = 0, length_CL = rv'c + rv'b && mask 7\<rparr>; dc uu_ xfdc\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q33672 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdca rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C uu_) (?Q'33672 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdca rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C uu_ xfdc) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))); seL4_MessageInfo_lift ret__struct_seL4_MessageInfo_C = \<lparr>label_CL = 0, capsUnwrapped_CL = 0, extraCaps_CL = 0, length_CL = rv'c + rv'b && mask 7\<rparr>\<rbrakk> \<Longrightarrow> \<lbrace>?R33674 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva\<rbrace> setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0) \<lbrace>?Q33672 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdca rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C s rvb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))); seL4_MessageInfo_lift ret__struct_seL4_MessageInfo_C = \<lparr>label_CL = 0, capsUnwrapped_CL = 0, extraCaps_CL = 0, length_CL = rv'c + rv'b && mask 7\<rparr>; dc rvb (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> ?Q'33672 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdca rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C rvb (xfdc s)
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rva. tcb_at' thread and ?R33674 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (\<lambda>rva rv'c. {s. \<forall>v. seL4_MessageInfo_lift v = \<lparr>label_CL = label_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 20, capsUnwrapped_CL = capsUnwrapped_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 3, extraCaps_CL = extraCaps_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 2, length_CL = length_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 7\<rparr> \<longrightarrow> s\<lparr>ret__struct_seL4_MessageInfo_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0 = message_info_to_H v\<rbrace>})
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> True)) and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>)} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
A total of 27 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdca rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C uu_ xfdcb rvb xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))); seL4_MessageInfo_lift ret__struct_seL4_MessageInfo_C = \<lparr>label_CL = 0, capsUnwrapped_CL = 0, extraCaps_CL = 0, length_CL = rv'c + rv'b && mask 7\<rparr>; dc uu_ xfdcb; dc rvb xfdc\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q33711 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdca rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C uu_ xfdcb rvb) (?Q'33711 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdca rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C uu_ xfdcb rvb xfdc) [SKIP] (return (Inr ())) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdca rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C uu_ xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))); seL4_MessageInfo_lift ret__struct_seL4_MessageInfo_C = \<lparr>label_CL = 0, capsUnwrapped_CL = 0, extraCaps_CL = 0, length_CL = rv'c + rv'b && mask 7\<rparr>; dc uu_ xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R33713 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdca rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C uu_\<rbrace> setThreadState Structures_H.thread_state.Running thread \<lbrace>?Q33711 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdca rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C uu_ xfdc\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))); seL4_MessageInfo_lift ret__struct_seL4_MessageInfo_C = \<lparr>label_CL = 0, capsUnwrapped_CL = 0, extraCaps_CL = 0, length_CL = rv'c + rv'b && mask 7\<rparr>\<rbrakk> \<Longrightarrow> \<lbrace>?R33674 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva\<rbrace> setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0) \<lbrace>\<lambda>uu_. (\<lambda>s. tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Running s \<and> (ksSchedulerAction s = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. thread \<in> set (ksReadyQueues s p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction s) s) and ?R33713 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C uu_\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdca rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C s rvb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))); seL4_MessageInfo_lift ret__struct_seL4_MessageInfo_C = \<lparr>label_CL = 0, capsUnwrapped_CL = 0, extraCaps_CL = 0, length_CL = rv'c + rv'b && mask 7\<rparr>; dc rvb (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rvc. dc rvc (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'33711 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdca rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C rvb (xfdc s) rvc (xfdc t)}
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rva. tcb_at' thread and ?R33674 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (\<lambda>rva rv'c. {s. \<forall>v. seL4_MessageInfo_lift v = \<lparr>label_CL = label_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 20, capsUnwrapped_CL = capsUnwrapped_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 3, extraCaps_CL = extraCaps_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 2, length_CL = length_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 7\<rparr> \<longrightarrow> s\<lparr>ret__struct_seL4_MessageInfo_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0 = message_info_to_H v\<rbrace>})
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> True)) and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>)} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
A total of 28 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdca rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C uu_ xfdcb rvb xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))); seL4_MessageInfo_lift ret__struct_seL4_MessageInfo_C = \<lparr>label_CL = 0, capsUnwrapped_CL = 0, extraCaps_CL = 0, length_CL = rv'c + rv'b && mask 7\<rparr>; dc uu_ xfdcb; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr ()) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ((intr_and_se_rel \<circ> Inr) \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdca rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C uu_ xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))); seL4_MessageInfo_lift ret__struct_seL4_MessageInfo_C = \<lparr>label_CL = 0, capsUnwrapped_CL = 0, extraCaps_CL = 0, length_CL = rv'c + rv'b && mask 7\<rparr>; dc uu_ xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R33713 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdca rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C uu_\<rbrace> setThreadState Structures_H.thread_state.Running thread \<lbrace>\<lambda>rvb _. True\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))); seL4_MessageInfo_lift ret__struct_seL4_MessageInfo_C = \<lparr>label_CL = 0, capsUnwrapped_CL = 0, extraCaps_CL = 0, length_CL = rv'c + rv'b && mask 7\<rparr>\<rbrakk> \<Longrightarrow> \<lbrace>?R33674 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva\<rbrace> setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0) \<lbrace>\<lambda>uu_. (\<lambda>s. tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Running s \<and> (ksSchedulerAction s = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. thread \<in> set (ksReadyQueues s p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction s) s) and ?R33713 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C uu_\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdca rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C s rvb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))); seL4_MessageInfo_lift ret__struct_seL4_MessageInfo_C = \<lparr>label_CL = 0, capsUnwrapped_CL = 0, extraCaps_CL = 0, length_CL = rv'c + rv'b && mask 7\<rparr>; dc rvb (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rva. tcb_at' thread and ?R33674 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (\<lambda>rva rv'c. {s. \<forall>v. seL4_MessageInfo_lift v = \<lparr>label_CL = label_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 20, capsUnwrapped_CL = capsUnwrapped_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 3, extraCaps_CL = extraCaps_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 2, length_CL = length_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 7\<rparr> \<longrightarrow> s\<lparr>ret__struct_seL4_MessageInfo_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0 = message_info_to_H v\<rbrace>})
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> True)) and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>)} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
A total of 28 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdca rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C uu_ xfdcb rvb xfdc \<sigma>. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))); seL4_MessageInfo_lift ret__struct_seL4_MessageInfo_C = \<lparr>label_CL = 0, capsUnwrapped_CL = 0, extraCaps_CL = 0, length_CL = rv'c + rv'b && mask 7\<rparr>; dc uu_ xfdcb; dc rvb xfdc\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr ()) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ((\<lambda>x. intr_and_se_rel (Inr x)) \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>))}
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdca rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C uu_ xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))); seL4_MessageInfo_lift ret__struct_seL4_MessageInfo_C = \<lparr>label_CL = 0, capsUnwrapped_CL = 0, extraCaps_CL = 0, length_CL = rv'c + rv'b && mask 7\<rparr>; dc uu_ xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R33713 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdca rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C uu_\<rbrace> setThreadState Structures_H.thread_state.Running thread \<lbrace>\<lambda>rvb _. True\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))); seL4_MessageInfo_lift ret__struct_seL4_MessageInfo_C = \<lparr>label_CL = 0, capsUnwrapped_CL = 0, extraCaps_CL = 0, length_CL = rv'c + rv'b && mask 7\<rparr>\<rbrakk> \<Longrightarrow> \<lbrace>?R33674 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva\<rbrace> setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0) \<lbrace>\<lambda>uu_. (\<lambda>s. tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Running s \<and> (ksSchedulerAction s = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. thread \<in> set (ksReadyQueues s p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction s) s) and ?R33713 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C uu_\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdca rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C s rvb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))); seL4_MessageInfo_lift ret__struct_seL4_MessageInfo_C = \<lparr>label_CL = 0, capsUnwrapped_CL = 0, extraCaps_CL = 0, length_CL = rv'c + rv'b && mask 7\<rparr>; dc rvb (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rva. tcb_at' thread and ?R33674 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (\<lambda>rva rv'c. {s. \<forall>v. seL4_MessageInfo_lift v = \<lparr>label_CL = label_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 20, capsUnwrapped_CL = capsUnwrapped_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 3, extraCaps_CL = extraCaps_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 2, length_CL = length_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 7\<rparr> \<longrightarrow> s\<lparr>ret__struct_seL4_MessageInfo_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0 = message_info_to_H v\<rbrace>})
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> True)) and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>)} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
A total of 28 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdca rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C uu_ xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))); seL4_MessageInfo_lift ret__struct_seL4_MessageInfo_C = \<lparr>label_CL = 0, capsUnwrapped_CL = 0, extraCaps_CL = 0, length_CL = rv'c + rv'b && mask 7\<rparr>; dc uu_ xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R33713 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdca rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C uu_\<rbrace> setThreadState Structures_H.thread_state.Running thread \<lbrace>\<lambda>rvb _. True\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))); seL4_MessageInfo_lift ret__struct_seL4_MessageInfo_C = \<lparr>label_CL = 0, capsUnwrapped_CL = 0, extraCaps_CL = 0, length_CL = rv'c + rv'b && mask 7\<rparr>\<rbrakk> \<Longrightarrow> \<lbrace>?R33674 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva\<rbrace> setMessageInfo thread (Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0) \<lbrace>\<lambda>uu_. (\<lambda>s. tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_tcb_state' Structures_H.thread_state.Running s \<and> (ksSchedulerAction s = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. thread \<in> set (ksReadyQueues s p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction s) s) and ?R33713 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C uu_\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdca rv'a rv rv'b rva rv'c ret__struct_seL4_MessageInfo_C s rvb. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))); seL4_MessageInfo_lift ret__struct_seL4_MessageInfo_C = \<lparr>label_CL = 0, capsUnwrapped_CL = 0, extraCaps_CL = 0, length_CL = rv'c + rv'b && mask 7\<rparr>; dc rvb (xfdc s)\<rbrakk> \<Longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = tcb_ptr_to_ctcb_ptr thread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rva. tcb_at' thread and ?R33674 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b rva\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (\<lambda>rva rv'c. {s. \<forall>v. seL4_MessageInfo_lift v = \<lparr>label_CL = label_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 20, capsUnwrapped_CL = capsUnwrapped_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 3, extraCaps_CL = extraCaps_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 2, length_CL = length_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 7\<rparr> \<longrightarrow> s\<lparr>ret__struct_seL4_MessageInfo_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0 = message_info_to_H v\<rbrace>})
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> True)) and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>)} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
A total of 27 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread e reply state destIPCBuffer ipcBuffer rv'a rv'b rv'c ret__struct_seL4_MessageInfo_C s. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); rv'c = word_of_nat (min (length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) - min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) - (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters))); seL4_MessageInfo_lift ret__struct_seL4_MessageInfo_C = \<lparr>label_CL = 0, capsUnwrapped_CL = 0, extraCaps_CL = 0, length_CL = word_of_nat (min (length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) - min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) - (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters))) + rv'b && mask 7\<rparr>\<rbrakk> \<Longrightarrow> s \<in> (if SCAST(32 signed \<rightarrow> 32) ThreadState_Running && mask 4 = SCAST(32 signed \<rightarrow> 32) ThreadState_Running then UNIV else {})
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rva. tcb_at' thread and (\<lambda>s. tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s)\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (\<lambda>rva rv'c. {s. \<forall>v. seL4_MessageInfo_lift v = \<lparr>label_CL = label_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 20, capsUnwrapped_CL = capsUnwrapped_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 3, extraCaps_CL = extraCaps_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 2, length_CL = length_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 7\<rparr> \<longrightarrow> s\<lparr>ret__struct_seL4_MessageInfo_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0 = message_info_to_H v\<rbrace>})
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> True)) and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>)} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
A total of 25 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> \<lbrace>?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rva. tcb_at' thread and (\<lambda>s. tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s)\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (\<lambda>rva rv'c. {s. \<forall>v. seL4_MessageInfo_lift v = \<lparr>label_CL = label_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 20, capsUnwrapped_CL = capsUnwrapped_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 3, extraCaps_CL = extraCaps_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 2, length_CL = length_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 7\<rparr> \<longrightarrow> s\<lparr>ret__struct_seL4_MessageInfo_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0 = message_info_to_H v\<rbrace>})
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> True)) and ?R9684 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>)} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
A total of 24 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b x. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); x \<in> set (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>tcb_at' thread and (\<lambda>s. tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s)\<rbrace> storeWordUser (fst x) (snd x) \<lbrace>\<lambda>rva. tcb_at' thread and (\<lambda>s. tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s)\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (\<lambda>rva rv'c. {s. \<forall>v. seL4_MessageInfo_lift v = \<lparr>label_CL = label_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 20, capsUnwrapped_CL = capsUnwrapped_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 3, extraCaps_CL = extraCaps_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 2, length_CL = length_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 7\<rparr> \<longrightarrow> s\<lparr>ret__struct_seL4_MessageInfo_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0 = message_info_to_H v\<rbrace>})
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s))\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>)} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
A total of 24 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b x. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); x \<in> set (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))\<rbrakk> \<Longrightarrow> \<lbrace>?Q33796 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b x\<rbrace> storeWordUser (fst x) (snd x) \<lbrace>\<lambda>rva. tcb_at' thread and (\<lambda>s. tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s)\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b x s. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); x \<in> set (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))); (tcb_at' thread and (\<lambda>s. tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s)) s\<rbrakk> \<Longrightarrow> ?Q33796 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b x s
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (\<lambda>rva rv'c. {s. \<forall>v. seL4_MessageInfo_lift v = \<lparr>label_CL = label_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 20, capsUnwrapped_CL = capsUnwrapped_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 3, extraCaps_CL = extraCaps_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 2, length_CL = length_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 7\<rparr> \<longrightarrow> s\<lparr>ret__struct_seL4_MessageInfo_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0 = message_info_to_H v\<rbrace>})
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s))\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>)} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
A total of 25 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b x s. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); x \<in> set (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))); (tcb_at' thread and (\<lambda>s. tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s)) s\<rbrakk> \<Longrightarrow> tcb_at' thread s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (\<lambda>rva rv'c. {s. \<forall>v. seL4_MessageInfo_lift v = \<lparr>label_CL = label_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 20, capsUnwrapped_CL = capsUnwrapped_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 3, extraCaps_CL = extraCaps_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 2, length_CL = length_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 7\<rparr> \<longrightarrow> s\<lparr>ret__struct_seL4_MessageInfo_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0 = message_info_to_H v\<rbrace>})
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s))\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>)} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
A total of 24 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a rv rv'b. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>a b. b = word_of_nat 0 + word_of_nat (length (zip (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) (drop (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))))) i_' (\<lambda>rva rv'c. {s. \<forall>v. seL4_MessageInfo_lift v = \<lparr>label_CL = label_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 20, capsUnwrapped_CL = capsUnwrapped_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 3, extraCaps_CL = extraCaps_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 2, length_CL = length_' (length_'_update (\<lambda>_. rv'c + rv'b) (extraCaps_'_update (\<lambda>_. 0) (capsUnwrapped_'_update (\<lambda>_. 0) (label_'_update (\<lambda>_. 0) s)))) && mask 7\<rparr> \<longrightarrow> s\<lparr>ret__struct_seL4_MessageInfo_C_' := v\<rparr> \<in> UNIV \<inter> \<lbrace>Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0 = message_info_to_H v\<rbrace>})
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s))\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>)} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
A total of 23 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>reply destIPCBuffer rv'b s v. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_' s = word_of_nat (min (length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) - min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) - (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters))); seL4_MessageInfo_lift v = \<lparr>label_CL = 0, capsUnwrapped_CL = 0, extraCaps_CL = 0, length_CL = word_of_nat (min (length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) - min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) - (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters))) + rv'b && mask 7\<rparr>\<rbrakk> \<Longrightarrow> Types_H.message_info.MI (word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) 0 0 0 = message_info_to_H v
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s))\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>)} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
A total of 23 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>reply destIPCBuffer rv'b s v. \<lbrakk>target \<noteq> thread; isCall; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); destIPCBuffer \<noteq> Some 0; (option_to_ptr destIPCBuffer = NULL) = (destIPCBuffer = None); unat rv'b = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters)); i_' s = word_of_nat (min (length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) - min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) - (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters))); seL4_MessageInfo_lift v = \<lparr>label_CL = 0, capsUnwrapped_CL = 0, extraCaps_CL = 0, length_CL = word_of_nat (min (length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) - min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) - (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters))) + rv'b && mask 7\<rparr>\<rbrakk> \<Longrightarrow> word_of_nat (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) = word_of_nat (min (length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) - min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])) - (min (unat n_frameRegisters - unat n_msgRegisters) (unat n) + unat n_msgRegisters))) + rv'b && mask 7
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s))\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>)} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
A total of 23 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>reply rv'b s v. \<lbrakk>i_' s = 0; seL4_MessageInfo_lift v = \<lparr>label_CL = 0, capsUnwrapped_CL = 0, extraCaps_CL = 0, length_CL = rv'b && mask 7\<rparr>; target \<noteq> thread; isCall; length reply = min (unat n) 19; option_to_ptr None = NULL; unat rv'b = min (unat n) 4\<rbrakk> \<Longrightarrow> word_of_nat (min (min (unat n) 19) 4) = rv'b && mask 7
 2. \<And>reply rv'b s v x2. \<lbrakk>i_' s = word_of_nat (min (min (unat n) 19) (4 + (121 - unat (1 + word_of_nat (length TCB_H.msgRegisters)))) - (4 + min 6 (unat n))); seL4_MessageInfo_lift v = \<lparr>label_CL = 0, capsUnwrapped_CL = 0, extraCaps_CL = 0, length_CL = rv'b + word_of_nat (min (min (unat n) 19) (4 + (121 - unat (1 + word_of_nat (length TCB_H.msgRegisters)))) - (4 + min 6 (unat n))) && mask 7\<rparr>; target \<noteq> thread; isCall; length reply = min (unat n) 19; x2 \<noteq> 0; option_to_ptr (Some x2) \<noteq> NULL; unat rv'b = min (unat n) 10\<rbrakk> \<Longrightarrow> word_of_nat (min (min (unat n) 19) (4 + (121 - unat (1 + word_of_nat (length TCB_H.msgRegisters))))) = rv'b + word_of_nat (min (min (unat n) 19) (4 + (121 - unat (1 + word_of_nat (length TCB_H.msgRegisters)))) - (4 + min 6 (unat n))) && mask 7
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s))\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>)} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
A total of 24 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>reply rv'b s v x2. \<lbrakk>i_' s = word_of_nat (min (min (unat n) 19) (4 + (121 - unat (1 + word_of_nat (length TCB_H.msgRegisters)))) - (4 + min 6 (unat n))); seL4_MessageInfo_lift v = \<lparr>label_CL = 0, capsUnwrapped_CL = 0, extraCaps_CL = 0, length_CL = rv'b + word_of_nat (min (min (unat n) 19) (4 + (121 - unat (1 + word_of_nat (length TCB_H.msgRegisters)))) - (4 + min 6 (unat n))) && mask 7\<rparr>; target \<noteq> thread; isCall; length reply = min (unat n) 19; x2 \<noteq> 0; option_to_ptr (Some x2) \<noteq> NULL; unat rv'b = min (unat n) 10\<rbrakk> \<Longrightarrow> word_of_nat (min (min (unat n) 19) (4 + (121 - unat (1 + word_of_nat (length TCB_H.msgRegisters))))) = rv'b + word_of_nat (min (min (unat n) 19) (4 + (121 - unat (1 + word_of_nat (length TCB_H.msgRegisters)))) - (4 + min 6 (unat n))) && mask 7
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s))\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>)} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
A total of 23 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>reply rv'b s v x2. \<lbrakk>i_' s = word_of_nat (min (unat n) 19 - (4 + min 6 (unat n))); seL4_MessageInfo_lift v = \<lparr>label_CL = 0, capsUnwrapped_CL = 0, extraCaps_CL = 0, length_CL = rv'b + word_of_nat (min (unat n) 19 - (4 + min 6 (unat n))) && mask 7\<rparr>; target \<noteq> thread; isCall; length reply = min (unat n) 19; x2 \<noteq> 0; option_to_ptr (Some x2) \<noteq> NULL; unat rv'b = min (unat n) 10\<rbrakk> \<Longrightarrow> word_of_nat (min (unat n) 19) = rv'b + word_of_nat (min (unat n) 19 - (4 + min 6 (unat n))) && mask 7
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s))\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>)} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
A total of 23 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> True)) and (tcb_at' thread and (\<lambda>s. tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s))\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>)} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 22 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> \<lbrace>?R6833 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer () xfdc ()\<rbrace> mapM_x (\<lambda>p. storeWordUser (fst p) (snd p)) (take (min (unat n_frameRegisters - unat n_msgRegisters) (unat n)) (zip (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]) (drop (unat n_msgRegisters) (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) \<lbrace>\<lambda>rv x. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target x \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) x \<and> valid_pspace' x) \<and> tcb_at' thread x \<and> Invariants_H.valid_queues x \<and> valid_objs' x \<and> sch_act_wf (ksSchedulerAction x) x\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>)} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and ?R6833 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc a and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 22 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer xfdc rv'a. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); rv'a = word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))); destIPCBuffer \<noteq> Some 0; (ipcBuffer = NULL) = (destIPCBuffer = None)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>_ rv. unat rv = min (unat n_frameRegisters) (min (unat n) (case destIPCBuffer of None \<Rightarrow> unat n_msgRegisters | Some a \<Rightarrow> unat n_frameRegisters))) i_' (\<lambda>rv rv'b. {s. j_'_update (\<lambda>_. rv'b) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> {s. s \<in> {sa. ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> sa \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> i_' s < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na) \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>)} \<inter> \<lbrace>\<^bsup>s\<^esup>i = 0\<rbrace>} \<inter> - \<lbrace>\<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace>}})
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and ?R5484 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a) b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a. (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> True)) and (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>_. destIPCBuffer \<noteq> Some 0)\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and ?R5484 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a) b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>?R6103 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) rv' self (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart destIPCBuffer ipcBuffer ()\<rbrace> mapM_x (\<lambda>x. asUser thread (setRegister (fst x) (snd x))) (zip TCB_H.msgRegisters (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)) \<lbrace>\<lambda>a b. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target b \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) b \<and> valid_pspace' b) \<and> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target b \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) b \<and> valid_pspace' b) \<and> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> sch_act_wf (ksSchedulerAction b) b \<and> destIPCBuffer \<noteq> Some 0\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and ?R6103 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and ?R5484 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a) b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 20 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer x. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); x \<in> set (zip TCB_H.msgRegisters (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> destIPCBuffer \<noteq> Some 0\<rbrace> asUser thread (setRegister (fst x) (snd x)) \<lbrace>\<lambda>rv a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> destIPCBuffer \<noteq> Some 0\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> destIPCBuffer \<noteq> Some 0) and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and ?R5484 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a) b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 20 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer x. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); x \<in> set (zip TCB_H.msgRegisters (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply))\<rbrakk> \<Longrightarrow> \<lbrace>?Q33977 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer x\<rbrace> asUser thread (setRegister (fst x) (snd x)) \<lbrace>\<lambda>rv a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> destIPCBuffer \<noteq> Some 0\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer x s. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); x \<in> set (zip TCB_H.msgRegisters (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)); ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s) \<and> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s) \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> destIPCBuffer \<noteq> Some 0\<rbrakk> \<Longrightarrow> ?Q33977 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer x s
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> destIPCBuffer \<noteq> Some 0) and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and ?R5484 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a) b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer x s. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; option_to_ptr destIPCBuffer = ipcBuffer; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters); x \<in> set (zip TCB_H.msgRegisters (take (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)); ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s) \<and> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s) \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> destIPCBuffer \<noteq> Some 0\<rbrakk> \<Longrightarrow> ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> (K (thread \<noteq> target) and obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target) s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s) \<and> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<longrightarrow> (K (thread \<noteq> target) and obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target) s \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) s \<and> valid_pspace' s) \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> destIPCBuffer \<noteq> Some 0
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> destIPCBuffer \<noteq> Some 0) and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and ?R5484 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a) b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer rv xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer; dc rv xfdc; length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (zip TCB_H.msgRegisters (take (min (length reply) (length TCB_H.msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength]))) reply)))) i_' (\<lambda>a b. {s. ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> ((\<exists>y. destIPCBuffer = Some y) \<and> b < na \<and> b < SCAST(32 signed \<rightarrow> 32) n_frameRegisters) \<longrightarrow> s \<in> \<lbrace>\<acute>i = b\<rbrace>)})
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> destIPCBuffer \<noteq> Some 0) and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and ?R5484 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a) b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv s. tcb_at' thread s \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> destIPCBuffer \<noteq> Some 0) and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) s\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and ?R5484 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a) b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<lbrace>?R6060 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer\<rbrace> asUser thread (setRegister Notification_H.badgeRegister 0) \<lbrace>\<lambda>rv. obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target and (\<lambda>a. ((\<exists>y. destIPCBuffer = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case destIPCBuffer of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> ((\<exists>y. destIPCBuffer = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_ipc_buffer_ptr' (the destIPCBuffer) a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> destIPCBuffer \<noteq> Some 0) and (\<lambda>_. length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and ?R6060 calla na suspendSource tcb_src cthread rv' self e reply rv a\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and ?R5484 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a) b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; state = Structures_H.thread_state.Restart; isCall; ((=) \<circ> option_to_ptr) destIPCBuffer ipcBuffer\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6058 calla na suspendSource tcb_src cthread rv' self e reply state destIPCBuffer ipcBuffer) CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> UNIV}
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. (K (thread \<noteq> target) and obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target) s \<and> ((\<exists>y. a = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case a of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case a of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> (K (thread \<noteq> target) and obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target) s \<and> valid_ipc_buffer_ptr' (the a) s \<and> valid_pspace' s) \<and> ((\<exists>y. a = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> (K (thread \<noteq> target) and obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target) s \<and> valid_ipc_buffer_ptr' (the a) s \<and> valid_pspace' s) \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> a \<noteq> Some 0 \<and> length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rva. ((=) \<circ> option_to_ptr) rva (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> ?R'6058 calla na suspendSource tcb_src cthread rv' self e reply rv rva (ipcBuffer_' s)}
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and ?R5484 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a) b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
 10. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. (K (thread \<noteq> target) and obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target) s \<and> ((\<exists>y. a = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case a of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < na \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case a of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> (K (thread \<noteq> target) and obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target) s \<and> valid_ipc_buffer_ptr' (the a) s \<and> valid_pspace' s) \<and> ((\<exists>y. a = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < na \<longrightarrow> (K (thread \<noteq> target) and obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target) s \<and> valid_ipc_buffer_ptr' (the a) s \<and> valid_pspace' s) \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> a \<noteq> Some 0 \<and> length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rv. ((=) \<circ> option_to_ptr) rv (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> \<lbrace>True\<rbrace>}
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and ?R5484 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a) b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
 9. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 10. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>?Q4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>, \<lbrace>?QE4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>a aa. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target aa \<and> ((\<exists>y. a = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case a of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case a of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target aa \<and> valid_ipc_buffer_ptr' (the a) aa \<and> valid_pspace' aa) \<and> ((\<exists>y. a = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target aa \<and> valid_ipc_buffer_ptr' (the a) aa \<and> valid_pspace' aa) \<and> tcb_at' thread aa \<and> Invariants_H.valid_queues aa \<and> valid_objs' aa \<and> sch_act_wf (ksSchedulerAction aa) aa \<and> a \<noteq> Some 0 \<and> length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rv. ((=) \<circ> option_to_ptr) rv (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> \<lbrace>True\<rbrace>}
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and ?R5484 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a) b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
 9. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 10. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>?Q4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>, \<lbrace>?QE4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>r s. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> ((\<exists>y. r = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case r of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case r of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> (r \<noteq> None \<and> (case r of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s) \<and> valid_pspace' s) \<and> ((\<exists>y. r = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> (r \<noteq> None \<and> (case r of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s) \<and> valid_pspace' s) \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> r \<noteq> Some 0 \<and> length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rv. ((=) \<circ> option_to_ptr) rv (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> \<lbrace>True\<rbrace>}
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and ?R5484 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a) b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
 9. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 10. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>?Q4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>, \<lbrace>?QE4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R5484 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> lookupIPCBuffer True thread \<lbrace>\<lambda>r s. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> ((\<exists>y. r = Some y) \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case r of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < n \<and> word_of_nat (min (unat n_msgRegisters) (min (min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) (unat n_msgRegisters + length (case r of None \<Rightarrow> [] | Some bufferPtr \<Rightarrow> map (\<lambda>x. bufferPtr + PPtr (x * 4)) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. msgMaxLength])))) < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> (case r of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> valid_pspace' s) \<and> ((\<exists>y. r = Some y) \<and> 0 < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target s \<and> (case r of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s \<and> valid_pspace' s) \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> r \<noteq> Some 0 \<and> length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rv. ((=) \<circ> option_to_ptr) rv (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> \<lbrace>True\<rbrace>}
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and ?R5484 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a) b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
 9. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 10. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>?Q4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>, \<lbrace>?QE4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) {s. \<forall>rv. ((=) \<circ> option_to_ptr) rv (ipcBuffer_' s) \<longrightarrow> s \<in> {s. w_'_update (\<lambda>_. 0) (reg_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H Notification_H.badgeRegister\<rbrace> \<inter> \<lbrace>\<acute>w = 0\<rbrace>} \<inter> \<lbrace>True\<rbrace>}
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> True \<and> length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
 8. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 9. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>?Q4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>, \<lbrace>?QE4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4696 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y rv' self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> {s'. \<forall>rva sa. (sa, s') \<in> rf_sr \<and> ?Q5348 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva sa \<longrightarrow> s' \<in> {s'. \<forall>rvb sa. (sa, s') \<in> rf_sr \<and> (rvb = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rva) target a \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rva) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rva) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> True \<and> length rva = min (unat na) (unat n_frameRegisters + unat n_gpRegisters))) sa) \<and> (\<not> isCall \<longrightarrow> ?R5387 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb sa)) \<and> (rvb \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False) \<longrightarrow> s' \<in> {sa. (rvb = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> {sa. (isCall \<longrightarrow> sa \<in> {sa. \<forall>v. ipcBuffer_'_update (\<lambda>_. v) sa \<in> {s. thread_'_update (\<lambda>_. cthread) (isReceiver_'_update (\<lambda>_. calla) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = cthread\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool True\<rbrace>} \<inter> ?R'5477 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb}) \<and> (\<not> isCall \<longrightarrow> sa \<in> ?T5389 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb)}) \<and> (rvb \<noteq> Structures_H.thread_state.Restart \<longrightarrow> sa \<in> UNIV)}}})) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''4693 calla na suspendSource tcb_src cthread y rv' self err (e_' s) (errstate s)))}
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) true; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; isCall\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'5477 (SCAST(32 signed \<rightarrow> 32) true) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) \<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread) UNIV
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> True \<and> length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
 8. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 9. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>?Q4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>, \<lbrace>?QE4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4696 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y rv' self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> {s'. \<forall>rva sa. (sa, s') \<in> rf_sr \<and> ?Q5348 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva sa \<longrightarrow> s' \<in> {s'. \<forall>rvb sa. (sa, s') \<in> rf_sr \<and> (rvb = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rva) target a \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rva) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rva) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> True \<and> length rva = min (unat na) (unat n_frameRegisters + unat n_gpRegisters))) sa) \<and> (\<not> isCall \<longrightarrow> ?R5387 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb sa)) \<and> (rvb \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False) \<longrightarrow> s' \<in> {sa. (rvb = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> {sa. (isCall \<longrightarrow> sa \<in> {sa. \<forall>v. ipcBuffer_'_update (\<lambda>_. v) sa \<in> {s. thread_'_update (\<lambda>_. cthread) (isReceiver_'_update (\<lambda>_. calla) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = cthread\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool True\<rbrace>} \<inter> ?R'5477 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb}) \<and> (\<not> isCall \<longrightarrow> sa \<in> ?T5389 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb)}) \<and> (rvb \<noteq> Structures_H.thread_state.Restart \<longrightarrow> sa \<in> UNIV)}}})) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''4693 calla na suspendSource tcb_src cthread y rv' self err (e_' s) (errstate s)))}
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) (?T5389 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply rv) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (IF isCall THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(0,0,0,\<acute>i + \<acute>j);;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> True \<and> length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
 7. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 8. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>?Q4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>, \<lbrace>?QE4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4696 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y rv' self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> {s'. \<forall>rva sa. (sa, s') \<in> rf_sr \<and> ?Q5348 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva sa \<longrightarrow> s' \<in> {s'. \<forall>rvb sa. (sa, s') \<in> rf_sr \<and> (rvb = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rva) target a \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rva) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rva) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> True \<and> length rva = min (unat na) (unat n_frameRegisters + unat n_gpRegisters))) sa) \<and> (\<not> isCall \<longrightarrow> ?R5387 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb sa)) \<and> (rvb \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False) \<longrightarrow> s' \<in> {sa. (rvb = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> {sa. (isCall \<longrightarrow> sa \<in> {s. \<forall>v. ipcBuffer_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. cthread) (isReceiver_'_update (\<lambda>_. calla) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = cthread\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> sa \<in> ?T5389 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb)}) \<and> (rvb \<noteq> Structures_H.thread_state.Restart \<longrightarrow> sa \<in> UNIV)}}})) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''4693 calla na suspendSource tcb_src cthread y rv' self err (e_' s) (errstate s)))}
 10. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>\<lambda>y s. \<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R4703 calla na suspendSource tcb_src cthread y rv) s\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) false; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?R5387 (SCAST(32 signed \<rightarrow> 32) false) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) (?T5389 (SCAST(32 signed \<rightarrow> 32) false) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart) [SKIP] (do r <- setThreadState Structures_H.thread_state.Running thread;
return (Inr ())
od) (CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> True \<and> length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) b) \<and> (\<not> isCall \<longrightarrow> ?R5387 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
 7. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 8. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>?Q4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>, \<lbrace>?QE4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4696 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y rv' self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> {s'. \<forall>rva sa. (sa, s') \<in> rf_sr \<and> ?Q5348 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva sa \<longrightarrow> s' \<in> {s'. \<forall>rvb sa. (sa, s') \<in> rf_sr \<and> (rvb = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rva) target a \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rva) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rva) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> True \<and> length rva = min (unat na) (unat n_frameRegisters + unat n_gpRegisters))) sa) \<and> (\<not> isCall \<longrightarrow> ?R5387 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb sa)) \<and> (rvb \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False) \<longrightarrow> s' \<in> {sa. (rvb = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> {sa. (isCall \<longrightarrow> sa \<in> {s. \<forall>v. ipcBuffer_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. cthread) (isReceiver_'_update (\<lambda>_. calla) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = cthread\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> sa \<in> ?T5389 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb)}) \<and> (rvb \<noteq> Structures_H.thread_state.Restart \<longrightarrow> sa \<in> UNIV)}}})) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''4693 calla na suspendSource tcb_src cthread y rv' self err (e_' s) (errstate s)))}
 10. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>\<lambda>y s. \<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R4703 calla na suspendSource tcb_src cthread y rv) s\<rbrace>
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv rva xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) false; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall; dc rva xfdc\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q34258 calla na suspendSource tcb_src cthread rv' self e reply rv rva) (?Q'34272 rv' self reply rva xfdc) [SKIP] (return (Inr ())) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) false; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R34266 (SCAST(32 signed \<rightarrow> 32) false) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> setThreadState Structures_H.thread_state.Running thread \<lbrace>?Q34258 calla na suspendSource tcb_src cthread rv' self e reply rv\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> True \<and> length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) b) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R34266 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a) b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
 8. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 9. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>?Q4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>, \<lbrace>?QE4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4696 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y rv' self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> {s'. \<forall>rva sa. (sa, s') \<in> rf_sr \<and> ?Q5348 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva sa \<longrightarrow> s' \<in> {s'. \<forall>rvb sa. (sa, s') \<in> rf_sr \<and> (rvb = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rva) target a \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rva) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rva) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> True \<and> length rva = min (unat na) (unat n_frameRegisters + unat n_gpRegisters))) sa) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R34266 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb) sa)) \<and> (rvb \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False) \<longrightarrow> s' \<in> {sa. (rvb = Structures_H.thread_state.Restart \<longrightarrow> sa \<in> {sa. (isCall \<longrightarrow> sa \<in> {s. \<forall>v. ipcBuffer_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. cthread) (isReceiver_'_update (\<lambda>_. calla) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = cthread\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> sa \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. cthread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = cthread\<rbrace>} \<inter> {s'. \<forall>t rvc. dc rvc (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'34271 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb t rvc})}) \<and> (rvb \<noteq> Structures_H.thread_state.Restart \<longrightarrow> sa \<in> UNIV)}}})) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''4693 calla na suspendSource tcb_src cthread y rv' self err (e_' s) (errstate s)))}
A total of 15 subgoals...
flex-flex pairs:
\<lambda>rv' self reply t rv. ?Q'34272 rv' self reply rv (xfdc t) \<equiv>\<^sup>? \<lambda>rv' self reply. ?Q'34271 (SCAST(32 signed \<rightarrow> 32) false) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart proof (prove)
goal (15 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv rva xfdc. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) false; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall; dc rva xfdc\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr ()) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ((intr_and_se_rel \<circ> Inr) \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) false; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R34266 (SCAST(32 signed \<rightarrow> 32) false) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> setThreadState Structures_H.thread_state.Running thread \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> True \<and> length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) b) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R34266 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a) b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
 8. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 9. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>?Q4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>, \<lbrace>?QE4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4696 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y rv' self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> {s'. \<forall>rva sa. (sa, s') \<in> rf_sr \<and> ?Q5348 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva sa \<longrightarrow> s' \<in> {s'. \<forall>rvb sa. (sa, s') \<in> rf_sr \<and> (rvb = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rva) target a \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rva) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rva) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> True \<and> length rva = min (unat na) (unat n_frameRegisters + unat n_gpRegisters))) sa) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R34266 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb) sa)) \<and> (rvb \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False) \<longrightarrow> s' \<in> {s. (rvb = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. \<forall>v. ipcBuffer_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. cthread) (isReceiver_'_update (\<lambda>_. calla) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = cthread\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. cthread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = cthread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})}) \<and> (rvb \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV)}}})) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''4693 calla na suspendSource tcb_src cthread y rv' self err (e_' s) (errstate s)))}
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv rva xfdc \<sigma>. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) false; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall; dc rva xfdc\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr ()) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ((\<lambda>x. intr_and_se_rel (Inr x)) \<currency> dc) rv (liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>))}
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) false; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R34266 (SCAST(32 signed \<rightarrow> 32) false) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> setThreadState Structures_H.thread_state.Running thread \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> True \<and> length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) b) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R34266 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a) b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
 8. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 9. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>?Q4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>, \<lbrace>?QE4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>
 10. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4696 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y rv' self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> {s'. \<forall>rva sa. (sa, s') \<in> rf_sr \<and> ?Q5348 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva sa \<longrightarrow> s' \<in> {s'. \<forall>rvb sa. (sa, s') \<in> rf_sr \<and> (rvb = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rva) target a \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rva) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rva) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> True \<and> length rva = min (unat na) (unat n_frameRegisters + unat n_gpRegisters))) sa) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R34266 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb) sa)) \<and> (rvb \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False) \<longrightarrow> s' \<in> {s. (rvb = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. \<forall>v. ipcBuffer_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. cthread) (isReceiver_'_update (\<lambda>_. calla) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = cthread\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. cthread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = cthread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})}) \<and> (rvb \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV)}}})) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''4693 calla na suspendSource tcb_src cthread y rv' self err (e_' s) (errstate s)))}
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply rv. \<lbrakk>target \<noteq> thread; calla = SCAST(32 signed \<rightarrow> 32) false; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; rv = Structures_H.thread_state.Restart; \<not> isCall\<rbrakk> \<Longrightarrow> \<lbrace>?R34266 (SCAST(32 signed \<rightarrow> 32) false) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply Structures_H.thread_state.Restart\<rbrace> setThreadState Structures_H.thread_state.Running thread \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e reply s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> getThreadState thread \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> True \<and> length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) b) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R34266 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply a) b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
 7. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 8. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>?Q4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>, \<lbrace>?QE4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4696 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y rv' self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> {s'. \<forall>rva sa. (sa, s') \<in> rf_sr \<and> ?Q5348 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva sa \<longrightarrow> s' \<in> {s'. \<forall>rvb sa. (sa, s') \<in> rf_sr \<and> (rvb = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rva) target a \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rva) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rva) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> True \<and> length rva = min (unat na) (unat n_frameRegisters + unat n_gpRegisters))) sa) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R34266 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva rvb) sa)) \<and> (rvb \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False) \<longrightarrow> s' \<in> {s. (rvb = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. \<forall>v. ipcBuffer_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. cthread) (isReceiver_'_update (\<lambda>_. calla) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = cthread\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. cthread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = cthread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})}) \<and> (rvb \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV)}}})) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''4693 calla na suspendSource tcb_src cthread y rv' self err (e_' s) (errstate s)))}
 10. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>\<lambda>y s. \<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R4703 calla na suspendSource tcb_src cthread y rv) s\<rbrace>
A total of 14 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (a = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> True \<and> length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters))) b) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) b)) \<and> (a \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False)\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
 5. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 6. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>?Q4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>, \<lbrace>?QE4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4696 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y rv' self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> {s'. \<forall>rva sa. (sa, s') \<in> rf_sr \<and> ?Q5348 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva sa \<longrightarrow> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rva) target a \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rva) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rva) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> True \<and> length rva = min (unat na) (unat n_frameRegisters + unat n_gpRegisters))) s) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) s)) \<and> (rv \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False) \<longrightarrow> s' \<in> {s. (rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. \<forall>v. ipcBuffer_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. cthread) (isReceiver_'_update (\<lambda>_. calla) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = cthread\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. cthread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = cthread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})}) \<and> (rv \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV)}}})) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''4693 calla na suspendSource tcb_src cthread y rv' self err (e_' s) (errstate s)))}
 8. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>\<lambda>y s. \<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R4703 calla na suspendSource tcb_src cthread y rv) s\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4648 calla na suspendSource tcb_src cthread\<^esub> (?R'4648 calla na suspendSource tcb_src cthread) IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>rv. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> sa \<in> {s. tcb_dest_'_update (\<lambda>_. ksCurThread_' (globals s)) (tcb_src_'_update (\<lambda>_. tcb_src) (arch_'_update (\<lambda>_. arch_' s) s)) \<in> UNIV} \<inter> ?R'4696 calla na suspendSource tcb_src cthread y (xfdc s) rv}}
 10. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> {s. (s \<in> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'4648 calla na suspendSource tcb_src (thread_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e reply. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) reply\<rbrace> getThreadState thread \<lbrace>\<lambda>a b. (isCall \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = reply) target b \<and> valid_pspace' b \<and> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> sch_act_wf (ksSchedulerAction b) b \<and> length reply = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) \<and> (\<not> isCall \<longrightarrow> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> sch_act_wf (ksSchedulerAction b) b) \<and> a = Structures_H.thread_state.Restart\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>?Q5348 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self () (SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
 5. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 6. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>?Q4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>, \<lbrace>?QE4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4696 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y rv' self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> {s'. \<forall>rva sa. (sa, s') \<in> rf_sr \<and> ?Q5348 calla na suspendSource tcb_src cthread y rv' self rv (e_' s) rva sa \<longrightarrow> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (rv = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rva) target a \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rva) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rva) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> True \<and> length rva = min (unat na) (unat n_frameRegisters + unat n_gpRegisters))) s) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) s)) \<and> (rv \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False) \<longrightarrow> s' \<in> {s. (rv = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. \<forall>v. ipcBuffer_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. cthread) (isReceiver_'_update (\<lambda>_. calla) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = cthread\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. cthread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = cthread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})}) \<and> (rv \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV)}}})) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''4693 calla na suspendSource tcb_src cthread y rv' self err (e_' s) (errstate s)))}
 8. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>\<lambda>y s. \<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R4703 calla na suspendSource tcb_src cthread y rv) s\<rbrace>
 9. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4648 calla na suspendSource tcb_src cthread\<^esub> (?R'4648 calla na suspendSource tcb_src cthread) IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>rv. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> sa \<in> {s. tcb_dest_'_update (\<lambda>_. ksCurThread_' (globals s)) (tcb_src_'_update (\<lambda>_. tcb_src) (arch_'_update (\<lambda>_. arch_' s) s)) \<in> UNIV} \<inter> ?R'4696 calla na suspendSource tcb_src cthread y (xfdc s) rv}}
 10. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> {s. (s \<in> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'4648 calla na suspendSource tcb_src (thread_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>r. (=) s\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?Q4693 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>a b. (isCall \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = a) target b \<and> valid_pspace' b \<and> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> sch_act_wf (ksSchedulerAction b) b \<and> length a = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)) \<and> (\<not> isCall \<longrightarrow> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> sch_act_wf (ksSchedulerAction b) b) \<and> st_tcb_at' (\<lambda>a. a = Structures_H.thread_state.Restart) thread b\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
 4. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 5. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>?Q4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>, \<lbrace>?QE4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4696 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y rv' self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (isCall \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target s \<and> valid_pspace' s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> length rv = min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) \<and> (\<not> isCall \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s) \<and> st_tcb_at' (\<lambda>a. a = Structures_H.thread_state.Restart) thread s \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (rva = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target a \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> True \<and> length rv = min (unat na) (unat n_frameRegisters + unat n_gpRegisters))) s) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) s)) \<and> (rva \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False) \<longrightarrow> s' \<in> {s. (rva = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. \<forall>v. ipcBuffer_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. cthread) (isReceiver_'_update (\<lambda>_. calla) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = cthread\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. cthread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = cthread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})}) \<and> (rva \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV)}}})) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''4693 calla na suspendSource tcb_src cthread y rv' self err (e_' s) (errstate s)))}
 7. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>\<lambda>y s. \<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R4703 calla na suspendSource tcb_src cthread y rv) s\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4648 calla na suspendSource tcb_src cthread\<^esub> (?R'4648 calla na suspendSource tcb_src cthread) IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>rv. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> sa \<in> {s. tcb_dest_'_update (\<lambda>_. ksCurThread_' (globals s)) (tcb_src_'_update (\<lambda>_. tcb_src) (arch_'_update (\<lambda>_. arch_' s) s)) \<in> UNIV} \<inter> ?R'4696 calla na suspendSource tcb_src cthread y (xfdc s) rv}}
 9. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> {s. (s \<in> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'4648 calla na suspendSource tcb_src (thread_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 10. \<And>calla na suspendSource tcb_src s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== \<acute>ksCurThread {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?P'34403 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>rv s. length rv = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?P'34349 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>rv s. (\<not> isCall \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s) \<and> st_tcb_at' (\<lambda>a. a = Structures_H.thread_state.Restart) thread s\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
 4. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 5. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>\<lambda>a b. (isCall \<longrightarrow> tcb_at' target b \<and> valid_pspace' b \<and> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> sch_act_wf (ksSchedulerAction b) b \<and> ?P'34403 calla na suspendSource tcb_src cthread y rv' self a b) \<and> ?P'34349 calla na suspendSource tcb_src cthread y rv' self a b\<rbrace>, \<lbrace>?QE4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4696 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y rv' self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (isCall \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target s \<and> valid_pspace' s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> length rv = min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) \<and> (\<not> isCall \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s) \<and> st_tcb_at' (\<lambda>a. a = Structures_H.thread_state.Restart) thread s \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (rva = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target a \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> True \<and> length rv = min (unat na) (unat n_frameRegisters + unat n_gpRegisters))) s) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) s)) \<and> (rva \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False) \<longrightarrow> s' \<in> {s. (rva = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. \<forall>v. ipcBuffer_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. cthread) (isReceiver_'_update (\<lambda>_. calla) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = cthread\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. cthread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = cthread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})}) \<and> (rva \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV)}}})) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''4693 calla na suspendSource tcb_src cthread y rv' self err (e_' s) (errstate s)))}
 7. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>\<lambda>y s. \<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R4703 calla na suspendSource tcb_src cthread y rv) s\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4648 calla na suspendSource tcb_src cthread\<^esub> (?R'4648 calla na suspendSource tcb_src cthread) IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>rv. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> sa \<in> {s. tcb_dest_'_update (\<lambda>_. ksCurThread_' (globals s)) (tcb_src_'_update (\<lambda>_. tcb_src) (arch_'_update (\<lambda>_. arch_' s) s)) \<in> UNIV} \<inter> ?R'4696 calla na suspendSource tcb_src cthread y (xfdc s) rv}}
 9. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> {s. (s \<in> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'4648 calla na suspendSource tcb_src (thread_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 10. \<And>calla na suspendSource tcb_src s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== \<acute>ksCurThread {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e rv s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; obj_at' (\<lambda>tcb. map ((atcbContextGet \<circ> tcbArch) tcb) (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target s\<rbrakk> \<Longrightarrow> length rv = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)
 2. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?P'34349 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>rv s. (\<not> isCall \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s) \<and> st_tcb_at' (\<lambda>a. a = Structures_H.thread_state.Restart) thread s\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
 4. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 5. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>\<lambda>a b. (isCall \<longrightarrow> tcb_at' target b \<and> valid_pspace' b \<and> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> sch_act_wf (ksSchedulerAction b) b \<and> tcb_at' target b) \<and> ?P'34349 calla na suspendSource tcb_src cthread y rv' self a b\<rbrace>, \<lbrace>?QE4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4696 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y rv' self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (isCall \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target s \<and> valid_pspace' s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> length rv = min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) \<and> (\<not> isCall \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s) \<and> st_tcb_at' (\<lambda>a. a = Structures_H.thread_state.Restart) thread s \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (rva = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target a \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> True \<and> length rv = min (unat na) (unat n_frameRegisters + unat n_gpRegisters))) s) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) s)) \<and> (rva \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False) \<longrightarrow> s' \<in> {s. (rva = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. \<forall>v. ipcBuffer_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. cthread) (isReceiver_'_update (\<lambda>_. calla) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = cthread\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. cthread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = cthread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})}) \<and> (rva \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV)}}})) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''4693 calla na suspendSource tcb_src cthread y rv' self err (e_' s) (errstate s)))}
 7. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>\<lambda>y s. \<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R4703 calla na suspendSource tcb_src cthread y rv) s\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4648 calla na suspendSource tcb_src cthread\<^esub> (?R'4648 calla na suspendSource tcb_src cthread) IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>rv. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> sa \<in> {s. tcb_dest_'_update (\<lambda>_. ksCurThread_' (globals s)) (tcb_src_'_update (\<lambda>_. tcb_src) (arch_'_update (\<lambda>_. arch_' s) s)) \<in> UNIV} \<inter> ?R'4696 calla na suspendSource tcb_src cthread y (xfdc s) rv}}
 9. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> {s. (s \<in> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'4648 calla na suspendSource tcb_src (thread_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 10. \<And>calla na suspendSource tcb_src s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== \<acute>ksCurThread {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s ko obj. \<lbrakk>target \<noteq> thread; ksPSpace s target = Some ko; is_aligned target (objBitsKO ko); fst (projectKO ko s) = {(obj, s)}; ps_clear target (objBitsKO ko) s\<rbrakk> \<Longrightarrow> min (unat n_frameRegisters) (unat n) + min (unat n_gpRegisters) (unat n - unat n_frameRegisters) = min (unat n) (unat n_frameRegisters + unat n_gpRegisters)
 2. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?P'34349 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>rv s. (\<not> isCall \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s) \<and> st_tcb_at' (\<lambda>a. a = Structures_H.thread_state.Restart) thread s\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
 4. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 5. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>\<lambda>a b. (isCall \<longrightarrow> tcb_at' target b \<and> valid_pspace' b \<and> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> sch_act_wf (ksSchedulerAction b) b \<and> tcb_at' target b) \<and> ?P'34349 calla na suspendSource tcb_src cthread y rv' self a b\<rbrace>, \<lbrace>?QE4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4696 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y rv' self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (isCall \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target s \<and> valid_pspace' s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> length rv = min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) \<and> (\<not> isCall \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s) \<and> st_tcb_at' (\<lambda>a. a = Structures_H.thread_state.Restart) thread s \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (rva = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target a \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> True \<and> length rv = min (unat na) (unat n_frameRegisters + unat n_gpRegisters))) s) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) s)) \<and> (rva \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False) \<longrightarrow> s' \<in> {s. (rva = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. \<forall>v. ipcBuffer_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. cthread) (isReceiver_'_update (\<lambda>_. calla) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = cthread\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. cthread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = cthread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})}) \<and> (rva \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV)}}})) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''4693 calla na suspendSource tcb_src cthread y rv' self err (e_' s) (errstate s)))}
 7. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>\<lambda>y s. \<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R4703 calla na suspendSource tcb_src cthread y rv) s\<rbrace>
 8. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4648 calla na suspendSource tcb_src cthread\<^esub> (?R'4648 calla na suspendSource tcb_src cthread) IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>rv. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> sa \<in> {s. tcb_dest_'_update (\<lambda>_. ksCurThread_' (globals s)) (tcb_src_'_update (\<lambda>_. tcb_src) (arch_'_update (\<lambda>_. arch_' s) s)) \<in> UNIV} \<inter> ?R'4696 calla na suspendSource tcb_src cthread y (xfdc s) rv}}
 9. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> {s. (s \<in> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'4648 calla na suspendSource tcb_src (thread_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 10. \<And>calla na suspendSource tcb_src s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== \<acute>ksCurThread {s'. (s, s') \<in> rf_sr}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> \<lbrace>?P'34349 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self ()\<rbrace> asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))) \<lbrace>\<lambda>rv s. (\<not> isCall \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s) \<and> st_tcb_at' (\<lambda>a. a = Structures_H.thread_state.Restart) thread s\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
 3. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 4. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>\<lambda>a b. (isCall \<longrightarrow> tcb_at' target b \<and> valid_pspace' b \<and> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> sch_act_wf (ksSchedulerAction b) b \<and> tcb_at' target b) \<and> ?P'34349 calla na suspendSource tcb_src cthread y rv' self a b\<rbrace>, \<lbrace>?QE4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4696 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y rv' self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (isCall \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target s \<and> valid_pspace' s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> length rv = min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) \<and> (\<not> isCall \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s) \<and> st_tcb_at' (\<lambda>a. a = Structures_H.thread_state.Restart) thread s \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (rva = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target a \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> True \<and> length rv = min (unat na) (unat n_frameRegisters + unat n_gpRegisters))) s) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) s)) \<and> (rva \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False) \<longrightarrow> s' \<in> {s. (rva = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. \<forall>v. ipcBuffer_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. cthread) (isReceiver_'_update (\<lambda>_. calla) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = cthread\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. cthread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = cthread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})}) \<and> (rva \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV)}}})) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''4693 calla na suspendSource tcb_src cthread y rv' self err (e_' s) (errstate s)))}
 6. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>\<lambda>y s. \<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R4703 calla na suspendSource tcb_src cthread y rv) s\<rbrace>
 7. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4648 calla na suspendSource tcb_src cthread\<^esub> (?R'4648 calla na suspendSource tcb_src cthread) IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>rv. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> sa \<in> {s. tcb_dest_'_update (\<lambda>_. ksCurThread_' (globals s)) (tcb_src_'_update (\<lambda>_. tcb_src) (arch_'_update (\<lambda>_. arch_' s) s)) \<in> UNIV} \<inter> ?R'4696 calla na suspendSource tcb_src cthread y (xfdc s) rv}}
 8. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> {s. (s \<in> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'4648 calla na suspendSource tcb_src (thread_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 9. \<And>calla na suspendSource tcb_src s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== \<acute>ksCurThread {s'. (s, s') \<in> rf_sr}
 10. \<And>calla na suspendSource tcb_src s s'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s \<and> s' \<in> ?Q'3967 calla na suspendSource tcb_src proof (prove)
goal (9 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; e = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE\<rbrakk> \<Longrightarrow> empty_fail (asUser target (mapM getRegister (genericTake n (TCB_H.frameRegisters @ TCB_H.gpRegisters))))
 2. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 3. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>\<lambda>a b. (isCall \<longrightarrow> tcb_at' target b \<and> valid_pspace' b \<and> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> sch_act_wf (ksSchedulerAction b) b \<and> tcb_at' target b) \<and> (\<not> isCall \<longrightarrow> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> sch_act_wf (ksSchedulerAction b) b) \<and> st_tcb_at' (\<lambda>a. a = Structures_H.thread_state.Restart) thread b\<rbrace>, \<lbrace>?QE4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4696 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y rv' self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (isCall \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target s \<and> valid_pspace' s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> length rv = min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) \<and> (\<not> isCall \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s) \<and> st_tcb_at' (\<lambda>a. a = Structures_H.thread_state.Restart) thread s \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (rva = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target a \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> True \<and> length rv = min (unat na) (unat n_frameRegisters + unat n_gpRegisters))) s) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) s)) \<and> (rva \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False) \<longrightarrow> s' \<in> {s. (rva = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. \<forall>v. ipcBuffer_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. cthread) (isReceiver_'_update (\<lambda>_. calla) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = cthread\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. cthread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = cthread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})}) \<and> (rva \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV)}}})) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''4693 calla na suspendSource tcb_src cthread y rv' self err (e_' s) (errstate s)))}
 5. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>\<lambda>y s. \<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R4703 calla na suspendSource tcb_src cthread y rv) s\<rbrace>
 6. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4648 calla na suspendSource tcb_src cthread\<^esub> (?R'4648 calla na suspendSource tcb_src cthread) IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>rv. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> sa \<in> {s. tcb_dest_'_update (\<lambda>_. ksCurThread_' (globals s)) (tcb_src_'_update (\<lambda>_. tcb_src) (arch_'_update (\<lambda>_. arch_' s) s)) \<in> UNIV} \<inter> ?R'4696 calla na suspendSource tcb_src cthread y (xfdc s) rv}}
 7. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> {s. (s \<in> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'4648 calla na suspendSource tcb_src (thread_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 8. \<And>calla na suspendSource tcb_src s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== \<acute>ksCurThread {s'. (s, s') \<in> rf_sr}
 9. \<And>calla na suspendSource tcb_src s s'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s \<and> s' \<in> ?Q'3967 calla na suspendSource tcb_src proof (prove)
goal (8 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread y rv' self err rv'a e. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'; id rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE; K (K (\<lambda>_. False)) err (id rv'a) e\<rbrakk> \<Longrightarrow> ccorres ((intr_and_se_rel \<circ> Inr) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (?QE4693 calla na suspendSource tcb_src cthread y rv' self err) (?Q''4693 calla na suspendSource tcb_src cthread y rv' self err rv'a e) [SKIP] (throwError err) (IF rv'a \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv'a)
FI;;
(IF from_bool isCall \<noteq> 0 THEN
  lvar_nondet_init ipcBuffer_' ipcBuffer_'_update;;
\<acute>ipcBuffer :== CALL lookupIPCBuffer_'proc(SCAST(32 signed \<rightarrow> 32) true,tcb_ptr_to_ctcb_ptr thread);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.badgeRegister,SCAST(32 signed \<rightarrow> 32) 0);;
\<acute>i :== 0;;
WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters THEN
  WHILE \<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_frameRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 0xA\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.frameRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>j :== \<acute>i;;
\<acute>i :== 0;;
WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < SCAST(32 signed \<rightarrow> 32) n_msgRegisters DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,kernel_all_global_addresses.msgRegisters.[unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters)],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1
OD;;
IF \<acute>ipcBuffer \<noteq> NULL \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n THEN
  WHILE \<acute>i < SCAST(32 signed \<rightarrow> 32) n_gpRegisters \<and> \<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters < n DO
  Guard ArrayBounds \<lbrace>\<acute>i < 9\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr target,kernel_all_global_addresses.gpRegisters.[unat \<acute>i]));;
Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (ipcBuffer_' s +\<^sub>p uint (i_' s + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))} (Guard MemorySafety \<lbrace>\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1 = 0 \<or> array_assertion \<acute>ipcBuffer (Suc (unat (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (\<acute>ipcBuffer +\<^sub>p uint (\<acute>i + SCAST(32 signed \<rightarrow> 32) n_frameRegisters + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1
OD
FI;;
\<acute>ret__struct_seL4_MessageInfo_C :== CALL seL4_MessageInfo_new_'proc(SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,SCAST(32 signed \<rightarrow> 32) 0,UCAST(32 \<rightarrow> 32) (\<acute>i + \<acute>j));;
\<acute>ret__unsigned_long :== CALL wordFromMessageInfo_'proc(\<acute>ret__struct_seL4_MessageInfo_C);;
CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) Kernel_C.msgInfoRegister,\<acute>ret__unsigned_long)
FI;;
(CALL setThreadState_'proc(tcb_ptr_to_ctcb_ptr thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Running);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>\<lambda>a b. (isCall \<longrightarrow> tcb_at' target b \<and> valid_pspace' b \<and> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> sch_act_wf (ksSchedulerAction b) b \<and> tcb_at' target b) \<and> (\<not> isCall \<longrightarrow> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> sch_act_wf (ksSchedulerAction b) b) \<and> st_tcb_at' (\<lambda>a. a = Structures_H.thread_state.Restart) thread b\<rbrace>, \<lbrace>?QE4693 calla na suspendSource tcb_src cthread y rv' self\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4696 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y rv' self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (isCall \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target s \<and> valid_pspace' s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> length rv = min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) \<and> (\<not> isCall \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s) \<and> st_tcb_at' (\<lambda>a. a = Structures_H.thread_state.Restart) thread s \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (rva = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target a \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> True \<and> length rv = min (unat na) (unat n_frameRegisters + unat n_gpRegisters))) s) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) s)) \<and> (rva \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False) \<longrightarrow> s' \<in> {s. (rva = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. \<forall>v. ipcBuffer_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. cthread) (isReceiver_'_update (\<lambda>_. calla) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = cthread\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. cthread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = cthread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})}) \<and> (rva \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV)}}})) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> ?Q''4693 calla na suspendSource tcb_src cthread y rv' self err (e_' s) (errstate s)))}
 4. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>\<lambda>y s. \<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R4703 calla na suspendSource tcb_src cthread y rv) s\<rbrace>
 5. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4648 calla na suspendSource tcb_src cthread\<^esub> (?R'4648 calla na suspendSource tcb_src cthread) IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>rv. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> sa \<in> {s. tcb_dest_'_update (\<lambda>_. ksCurThread_' (globals s)) (tcb_src_'_update (\<lambda>_. tcb_src) (arch_'_update (\<lambda>_. arch_' s) s)) \<in> UNIV} \<inter> ?R'4696 calla na suspendSource tcb_src cthread y (xfdc s) rv}}
 6. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> {s. (s \<in> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'4648 calla na suspendSource tcb_src (thread_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 7. \<And>calla na suspendSource tcb_src s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== \<acute>ksCurThread {s'. (s, s') \<in> rf_sr}
 8. \<And>calla na suspendSource tcb_src s s'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s \<and> s' \<in> ?Q'3967 calla na suspendSource tcb_src proof (prove)
goal (7 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y self\<rbrace> liftE (performTransfer archCp target self) \<lbrace>\<lambda>a b. (isCall \<longrightarrow> tcb_at' target b \<and> valid_pspace' b \<and> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> sch_act_wf (ksSchedulerAction b) b \<and> tcb_at' target b) \<and> (\<not> isCall \<longrightarrow> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> sch_act_wf (ksSchedulerAction b) b) \<and> st_tcb_at' (\<lambda>a. a = Structures_H.thread_state.Restart) thread b\<rbrace>, \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4696 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y rv' self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (isCall \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target s \<and> valid_pspace' s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> length rv = min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) \<and> (\<not> isCall \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s) \<and> st_tcb_at' (\<lambda>a. a = Structures_H.thread_state.Restart) thread s \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (rva = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target a \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> True \<and> length rv = min (unat na) (unat n_frameRegisters + unat n_gpRegisters))) s) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) s)) \<and> (rva \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False) \<longrightarrow> s' \<in> {s. (rva = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. \<forall>v. ipcBuffer_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. cthread) (isReceiver_'_update (\<lambda>_. calla) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = cthread\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. cthread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = cthread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})}) \<and> (rva \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV)}}})) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> UNIV))}
 3. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>\<lambda>y s. \<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R4703 calla na suspendSource tcb_src cthread y rv) s\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4648 calla na suspendSource tcb_src cthread\<^esub> (?R'4648 calla na suspendSource tcb_src cthread) IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>rv. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> sa \<in> {s. tcb_dest_'_update (\<lambda>_. ksCurThread_' (globals s)) (tcb_src_'_update (\<lambda>_. tcb_src) (arch_'_update (\<lambda>_. arch_' s) s)) \<in> UNIV} \<inter> ?R'4696 calla na suspendSource tcb_src cthread y (xfdc s) rv}}
 5. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> {s. (s \<in> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'4648 calla na suspendSource tcb_src (thread_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 6. \<And>calla na suspendSource tcb_src s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== \<acute>ksCurThread {s'. (s, s') \<in> rf_sr}
 7. \<And>calla na suspendSource tcb_src s s'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s \<and> s' \<in> ?Q'3967 calla na suspendSource tcb_src proof (prove)
goal (7 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4703 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () self\<rbrace> return () \<lbrace>\<lambda>a b. (isCall \<longrightarrow> tcb_at' target b \<and> valid_pspace' b \<and> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> sch_act_wf (ksSchedulerAction b) b \<and> tcb_at' target b) \<and> (\<not> isCall \<longrightarrow> tcb_at' thread b \<and> Invariants_H.valid_queues b \<and> valid_objs' b \<and> sch_act_wf (ksSchedulerAction b) b) \<and> st_tcb_at' (\<lambda>a. a = Structures_H.thread_state.Restart) thread b\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4696 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y rv' self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (isCall \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target s \<and> valid_pspace' s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> length rv = min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) \<and> (\<not> isCall \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s) \<and> st_tcb_at' (\<lambda>a. a = Structures_H.thread_state.Restart) thread s \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (rva = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target a \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> True \<and> length rv = min (unat na) (unat n_frameRegisters + unat n_gpRegisters))) s) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) s)) \<and> (rva \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False) \<longrightarrow> s' \<in> {s. (rva = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. \<forall>v. ipcBuffer_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. cthread) (isReceiver_'_update (\<lambda>_. calla) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = cthread\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. cthread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = cthread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})}) \<and> (rva \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV)}}})) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> UNIV))}
 3. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>\<lambda>y s. \<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and ?R4703 calla na suspendSource tcb_src cthread y rv) s\<rbrace>
 4. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4648 calla na suspendSource tcb_src cthread\<^esub> (?R'4648 calla na suspendSource tcb_src cthread) IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>rv. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> sa \<in> {s. tcb_dest_'_update (\<lambda>_. ksCurThread_' (globals s)) (tcb_src_'_update (\<lambda>_. tcb_src) (arch_'_update (\<lambda>_. arch_' s) s)) \<in> UNIV} \<inter> ?R'4696 calla na suspendSource tcb_src cthread y (xfdc s) rv}}
 5. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> {s. (s \<in> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'4648 calla na suspendSource tcb_src (thread_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 6. \<And>calla na suspendSource tcb_src s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== \<acute>ksCurThread {s'. (s, s') \<in> rf_sr}
 7. \<And>calla na suspendSource tcb_src s s'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s \<and> s' \<in> ?Q'3967 calla na suspendSource tcb_src proof (prove)
goal (6 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread y rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; dc y rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4696 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) y rv' self) \<acute>e :== CALL Arch_performTransfer_'proc(\<acute>arch,tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread) {s. (id (e_' s) = SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>rv. dc rv (K () (e_' s)) \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (isCall \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target s \<and> valid_pspace' s \<and> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s \<and> length rv = min (unat na) (unat n_frameRegisters + unat n_gpRegisters)) \<and> (\<not> isCall \<longrightarrow> tcb_at' thread s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s) \<and> st_tcb_at' (\<lambda>a. a = Structures_H.thread_state.Restart) thread s \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> (rva = Structures_H.thread_state.Restart \<longrightarrow> (isCall \<longrightarrow> (tcb_at' thread and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target a \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> (obj_at' (\<lambda>tcb. map (atcbContextGet (tcbArch tcb)) (genericTake na (TCB_H.frameRegisters @ TCB_H.gpRegisters)) = rv) target a \<and> valid_objs' a \<and> valid_pspace' a) \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> True \<and> length rv = min (unat na) (unat n_frameRegisters + unat n_gpRegisters))) s) \<and> (\<not> isCall \<longrightarrow> ((\<lambda>a. tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> valid_tcb_state' Structures_H.thread_state.Running a \<and> (ksSchedulerAction a = SwitchToThread thread \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> (\<forall>p. thread \<in> set (ksReadyQueues a p) \<longrightarrow> runnable' Structures_H.thread_state.Running) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. True)) s)) \<and> (rva \<noteq> Structures_H.thread_state.Restart \<longrightarrow> False) \<longrightarrow> s' \<in> {s. (rva = Structures_H.thread_state.Restart \<longrightarrow> s \<in> {s. (isCall \<longrightarrow> s \<in> {s. \<forall>v. ipcBuffer_'_update (\<lambda>_. v) s \<in> {s. thread_'_update (\<lambda>_. cthread) (isReceiver_'_update (\<lambda>_. calla) s) \<in> UNIV \<inter> \<lbrace>\<acute>thread = cthread\<rbrace> \<inter> \<lbrace>\<acute>isReceiver = from_bool True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}) \<and> (\<not> isCall \<longrightarrow> s \<in> {s. ts_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) ThreadState_Running) (tptr_'_update (\<lambda>_. cthread) s) \<in> \<lbrace>\<forall>cl fl. cthread_state_relation_lifted Structures_H.thread_state.Running (cl\<lparr>tsType_CL := \<acute>ts && mask 4\<rparr>, fl)\<rbrace> \<inter> \<lbrace>\<acute>tptr = cthread\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV})}) \<and> (rva \<noteq> Structures_H.thread_state.Restart \<longrightarrow> s \<in> UNIV)}}})) \<and> (id (e_' s) \<noteq> SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE \<longrightarrow> (\<forall>err. K (K (\<lambda>_. False)) err (id (e_' s)) (errstate s) \<longrightarrow> s \<in> UNIV))}
 2. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>\<lambda>y s. \<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (isCall \<longrightarrow> tcb_at' target a \<and> valid_pspace' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> tcb_at' target a) \<and> (\<not> isCall \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a) \<and> st_tcb_at' (\<lambda>a. a = Structures_H.thread_state.Restart) thread a)) s\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4648 calla na suspendSource tcb_src cthread\<^esub> (?R'4648 calla na suspendSource tcb_src cthread) IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>rv. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> sa \<in> {s. tcb_dest_'_update (\<lambda>_. ksCurThread_' (globals s)) (tcb_src_'_update (\<lambda>_. tcb_src) (arch_'_update (\<lambda>_. arch_' s) s)) \<in> UNIV} \<inter> ?R'4696 calla na suspendSource tcb_src cthread y (xfdc s) rv}}
 4. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> {s. (s \<in> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'4648 calla na suspendSource tcb_src (thread_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 5. \<And>calla na suspendSource tcb_src s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== \<acute>ksCurThread {s'. (s, s') \<in> rf_sr}
 6. \<And>calla na suspendSource tcb_src s s'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s \<and> s' \<in> ?Q'3967 calla na suspendSource tcb_src proof (prove)
goal (6 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv' self. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4696 (from_bool isCall) n (from_bool susp) (tcb_ptr_to_ctcb_ptr target) (tcb_ptr_to_ctcb_ptr thread) () rv' self) \<acute>e :== CALL Arch_performTransfer_'proc(tcb_ptr_to_ctcb_ptr target,\<acute>ksCurThread) UNIV
 2. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>\<lambda>y s. \<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (isCall \<longrightarrow> tcb_at' target a \<and> valid_pspace' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> tcb_at' target a) \<and> (\<not> isCall \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a) \<and> st_tcb_at' (\<lambda>a. a = Structures_H.thread_state.Restart) thread a)) s\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4648 calla na suspendSource tcb_src cthread\<^esub> (?R'4648 calla na suspendSource tcb_src cthread) IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>rv. ksCurThread_' (globals sa) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> sa \<in> {s. tcb_dest_'_update (\<lambda>_. ksCurThread_' (globals s)) (tcb_src_'_update (\<lambda>_. tcb_src) (arch_'_update (\<lambda>_. arch_' s) s)) \<in> UNIV} \<inter> ?R'4696 calla na suspendSource tcb_src cthread y (xfdc s) rv}}
 4. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> {s. (s \<in> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'4648 calla na suspendSource tcb_src (thread_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 5. \<And>calla na suspendSource tcb_src s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== \<acute>ksCurThread {s'. (s, s') \<in> rf_sr}
 6. \<And>calla na suspendSource tcb_src s s'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s \<and> s' \<in> ?Q'3967 calla na suspendSource tcb_src proof (prove)
goal (5 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>\<lambda>y s. \<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (isCall \<longrightarrow> tcb_at' target a \<and> valid_pspace' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> tcb_at' target a) \<and> (\<not> isCall \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a) \<and> st_tcb_at' (\<lambda>a. a = Structures_H.thread_state.Restart) thread a)) s\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4648 calla na suspendSource tcb_src cthread\<^esub> (?R'4648 calla na suspendSource tcb_src cthread) IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. ksCurThread_' (globals s)) (tcb_src_'_update (\<lambda>_. tcb_src) (arch_'_update (\<lambda>_. arch_' s) s)) \<in> UNIV} \<inter> \<lbrace>True\<rbrace>}}
 3. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> {s. (s \<in> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'4648 calla na suspendSource tcb_src (thread_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 4. \<And>calla na suspendSource tcb_src s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== \<acute>ksCurThread {s'. (s, s') \<in> rf_sr}
 5. \<And>calla na suspendSource tcb_src s s'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s \<and> s' \<in> ?Q'3967 calla na suspendSource tcb_src proof (prove)
goal (6 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread rv s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread; (invs' and st_tcb_at' ((=) Structures_H.thread_state.Restart) thread and tcb_at' target) s\<rbrakk> \<Longrightarrow> \<forall>rv. ksCurThread s = rv \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. (isCall \<longrightarrow> tcb_at' target a \<and> valid_pspace' a \<and> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a \<and> tcb_at' target a) \<and> (\<not> isCall \<longrightarrow> tcb_at' thread a \<and> Invariants_H.valid_queues a \<and> valid_objs' a \<and> sch_act_wf (ksSchedulerAction a) a) \<and> st_tcb_at' (\<lambda>a. a = Structures_H.thread_state.Restart) thread a)) s
 2. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>\<lambda>rv. invs' and st_tcb_at' ((=) Structures_H.thread_state.Restart) thread and tcb_at' target\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4648 calla na suspendSource tcb_src cthread\<^esub> (?R'4648 calla na suspendSource tcb_src cthread) IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. ksCurThread_' (globals s)) (tcb_src_'_update (\<lambda>_. tcb_src) (arch_'_update (\<lambda>_. arch_' s) s)) \<in> UNIV} \<inter> \<lbrace>True\<rbrace>}}
 4. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> {s. (s \<in> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'4648 calla na suspendSource tcb_src (thread_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 5. \<And>calla na suspendSource tcb_src s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== \<acute>ksCurThread {s'. (s, s') \<in> rf_sr}
 6. \<And>calla na suspendSource tcb_src s s'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s \<and> s' \<in> ?Q'3967 calla na suspendSource tcb_src proof (prove)
goal (6 subgoals):
 1. \<And>s. \<lbrakk>target \<noteq> thread; invs' s; st_tcb_at' ((=) Structures_H.thread_state.Restart) thread s; tcb_at' target s\<rbrakk> \<Longrightarrow> (isCall \<longrightarrow> valid_pspace' s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s) \<and> (\<not> isCall \<longrightarrow> Invariants_H.valid_queues s \<and> valid_objs' s \<and> sch_act_wf (ksSchedulerAction s) s) \<and> st_tcb_at' (\<lambda>a. a = Structures_H.thread_state.Restart) thread s
 2. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>\<lambda>rv. invs' and st_tcb_at' ((=) Structures_H.thread_state.Restart) thread and tcb_at' target\<rbrace>
 3. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4648 calla na suspendSource tcb_src cthread\<^esub> (?R'4648 calla na suspendSource tcb_src cthread) IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. ksCurThread_' (globals s)) (tcb_src_'_update (\<lambda>_. tcb_src) (arch_'_update (\<lambda>_. arch_' s) s)) \<in> UNIV} \<inter> \<lbrace>True\<rbrace>}}
 4. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> {s. (s \<in> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'4648 calla na suspendSource tcb_src (thread_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 5. \<And>calla na suspendSource tcb_src s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== \<acute>ksCurThread {s'. (s, s') \<in> rf_sr}
 6. \<And>calla na suspendSource tcb_src s s'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s \<and> s' \<in> ?Q'3967 calla na suspendSource tcb_src proof (prove)
goal (5 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<lbrace>?R4650 calla na suspendSource tcb_src\<rbrace> when susp (ThreadDecls_H.suspend target) \<lbrace>\<lambda>rv. invs' and st_tcb_at' ((=) Structures_H.thread_state.Restart) thread and tcb_at' target\<rbrace>
 2. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4648 calla na suspendSource tcb_src cthread\<^esub> (?R'4648 calla na suspendSource tcb_src cthread) IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. ksCurThread_' (globals s)) (tcb_src_'_update (\<lambda>_. tcb_src) (arch_'_update (\<lambda>_. arch_' s) s)) \<in> UNIV} \<inter> \<lbrace>True\<rbrace>}}
 3. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> {s. (s \<in> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'4648 calla na suspendSource tcb_src (thread_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 4. \<And>calla na suspendSource tcb_src s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== \<acute>ksCurThread {s'. (s, s') \<in> rf_sr}
 5. \<And>calla na suspendSource tcb_src s s'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and ?R4650 calla na suspendSource tcb_src) s \<and> s' \<in> ?Q'3967 calla na suspendSource tcb_src proof (prove)
goal (4 subgoals):
 1. \<And>calla na suspendSource tcb_src cthread. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; cthread = tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F4648 calla na suspendSource tcb_src cthread\<^esub> (?R'4648 calla na suspendSource tcb_src cthread) IF suspendSource \<noteq> 0 THEN
  CALL suspend_'proc(tcb_src)
FI {s. \<forall>y. dc y (xfdc s) \<longrightarrow> s \<in> {s. \<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> s \<in> {s. tcb_dest_'_update (\<lambda>_. ksCurThread_' (globals s)) (tcb_src_'_update (\<lambda>_. tcb_src) (arch_'_update (\<lambda>_. arch_' s) s)) \<in> UNIV} \<inter> \<lbrace>True\<rbrace>}}
 2. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> {s. (s \<in> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> ?R'4648 calla na suspendSource tcb_src (thread_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 3. \<And>calla na suspendSource tcb_src s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and (if susp then \<lambda>a. (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) a \<and> ((target \<noteq> thread \<longrightarrow> st_tcb_at' ((=) Structures_H.thread_state.Restart) thread a) \<and> (target = thread \<longrightarrow> Structures_H.thread_state.Restart = Structures_H.thread_state.Inactive)) \<and> tcb_at' target a else (\<lambda>s. invs' s \<and> st_tcb_at' ((=) Structures_H.thread_state.Restart) thread s \<and> tcb_at' target s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== \<acute>ksCurThread {s'. (s, s') \<in> rf_sr}
 4. \<And>calla na suspendSource tcb_src s s'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and (if susp then \<lambda>a. (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) a \<and> ((target \<noteq> thread \<longrightarrow> st_tcb_at' ((=) Structures_H.thread_state.Restart) thread a) \<and> (target = thread \<longrightarrow> Structures_H.thread_state.Restart = Structures_H.thread_state.Inactive)) \<and> tcb_at' target a else (\<lambda>s. invs' s \<and> st_tcb_at' ((=) Structures_H.thread_state.Restart) thread s \<and> tcb_at' target s))) s \<and> s' \<in> ?Q'3967 calla na suspendSource tcb_src proof (prove)
goal (3 subgoals):
 1. \<And>calla na suspendSource tcb_src. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src) \<acute>thread :== \<acute>ksCurThread {s. s \<in> {s. (s \<in> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> {s. target_'_update (\<lambda>_. tcb_src) s \<in> UNIV \<inter> \<lbrace>\<acute>target = tcb_src\<rbrace>}) \<and> (s \<notin> \<lbrace>susp\<rbrace> \<longrightarrow> s \<in> UNIV)} \<inter> {s. (suspendSource \<noteq> 0 \<longrightarrow> True) \<and> (\<not> suspendSource \<noteq> 0 \<longrightarrow> (\<forall>y. dc y (xfdc s) \<longrightarrow> (\<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> True \<and> True)))} \<inter> \<lbrace>\<^bsup>s\<^esup>thread = tcb_ptr_to_ctcb_ptr thread\<rbrace>}
 2. \<And>calla na suspendSource tcb_src s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and (if susp then \<lambda>a. (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) a \<and> ((target \<noteq> thread \<longrightarrow> st_tcb_at' ((=) Structures_H.thread_state.Restart) thread a) \<and> (target = thread \<longrightarrow> Structures_H.thread_state.Restart = Structures_H.thread_state.Inactive)) \<and> tcb_at' target a else (\<lambda>s. invs' s \<and> st_tcb_at' ((=) Structures_H.thread_state.Restart) thread s \<and> tcb_at' target s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'3967 calla na suspendSource tcb_src \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== \<acute>ksCurThread {s'. (s, s') \<in> rf_sr}
 3. \<And>calla na suspendSource tcb_src s s'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and (if susp then \<lambda>a. (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) a \<and> ((target \<noteq> thread \<longrightarrow> st_tcb_at' ((=) Structures_H.thread_state.Restart) thread a) \<and> (target = thread \<longrightarrow> Structures_H.thread_state.Restart = Structures_H.thread_state.Inactive)) \<and> tcb_at' target a else (\<lambda>s. invs' s \<and> st_tcb_at' ((=) Structures_H.thread_state.Restart) thread s \<and> tcb_at' target s))) s \<and> s' \<in> ?Q'3967 calla na suspendSource tcb_src proof (prove)
goal (2 subgoals):
 1. \<And>calla na suspendSource tcb_src s. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and (if susp then \<lambda>a. (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) a \<and> ((target \<noteq> thread \<longrightarrow> st_tcb_at' ((=) Structures_H.thread_state.Restart) thread a) \<and> (target = thread \<longrightarrow> Structures_H.thread_state.Restart = Structures_H.thread_state.Inactive)) \<and> tcb_at' target a else (\<lambda>s. invs' s \<and> st_tcb_at' ((=) Structures_H.thread_state.Restart) thread s \<and> tcb_at' target s))) s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (susp \<longrightarrow> True \<and> tcb_src = tcb_src) \<and> (\<not> susp \<longrightarrow> True) \<and> (suspendSource \<noteq> 0 \<longrightarrow> True) \<and> (\<not> suspendSource \<noteq> 0 \<longrightarrow> (\<forall>y. dc y (xfdc (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s)) \<longrightarrow> (\<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> True \<and> True))) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread} \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>thread :== \<acute>ksCurThread {s'. (s, s') \<in> rf_sr}
 2. \<And>calla na suspendSource tcb_src s s'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and (if susp then \<lambda>a. (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) a \<and> ((target \<noteq> thread \<longrightarrow> st_tcb_at' ((=) Structures_H.thread_state.Restart) thread a) \<and> (target = thread \<longrightarrow> Structures_H.thread_state.Restart = Structures_H.thread_state.Inactive)) \<and> tcb_at' target a else (\<lambda>s. invs' s \<and> st_tcb_at' ((=) Structures_H.thread_state.Restart) thread s \<and> tcb_at' target s))) s \<and> s' \<in> {s. (susp \<longrightarrow> True \<and> tcb_src = tcb_src) \<and> (\<not> susp \<longrightarrow> True) \<and> (suspendSource \<noteq> 0 \<longrightarrow> True) \<and> (\<not> suspendSource \<noteq> 0 \<longrightarrow> (\<forall>y. dc y (xfdc (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s)) \<longrightarrow> (\<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> True \<and> True))) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread} proof (prove)
goal (1 subgoal):
 1. \<And>calla na suspendSource tcb_src s s'. \<lbrakk>target \<noteq> thread; calla = from_bool isCall; na = n; suspendSource = from_bool susp; tcb_src = tcb_ptr_to_ctcb_ptr target; (s, s') \<in> rf_sr; (invs' and (\<lambda>s. ksCurThread s = thread) and ct_in_state' ((=) Structures_H.thread_state.Restart) and tcb_at' target and sch_act_simple and (\<lambda>s. target \<noteq> ksIdleThread s)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. susp \<longrightarrow> (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) s) and (\<lambda>s. \<not> susp \<longrightarrow> True) and (if susp then \<lambda>a. (invs' and sch_act_simple and tcb_at' target and (\<lambda>s. target \<noteq> ksIdleThread s)) a \<and> ((target \<noteq> thread \<longrightarrow> st_tcb_at' ((=) Structures_H.thread_state.Restart) thread a) \<and> (target = thread \<longrightarrow> Structures_H.thread_state.Restart = Structures_H.thread_state.Inactive)) \<and> tcb_at' target a else (\<lambda>s. invs' s \<and> st_tcb_at' ((=) Structures_H.thread_state.Restart) thread s \<and> tcb_at' target s))) s \<and> s' \<in> {s. (susp \<longrightarrow> True \<and> tcb_src = tcb_src) \<and> (\<not> susp \<longrightarrow> True) \<and> (suspendSource \<noteq> 0 \<longrightarrow> True) \<and> (\<not> suspendSource \<noteq> 0 \<longrightarrow> (\<forall>y. dc y (xfdc (thread_'_update (\<lambda>_. ksCurThread_' (globals s)) s)) \<longrightarrow> (\<forall>rv. ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr rv \<longrightarrow> True \<and> True))) \<and> ksCurThread_' (globals s) = tcb_ptr_to_ctcb_ptr thread} proof (prove)
goal:
No subgoals!