theory RPCTo

lemma RPCTo_run_internal_wp[wp_unsafe]:
  notes seL4_SetMR_axiom[simp] seL4_SetMR_wp[wp] seL4_GetMR_wp[wp]
  shows
  "\<lbrace>\<lambda>s64'. globals_frame_intact s64' \<and>
           tls_valid s64' \<and>
           thread_index_C (tls s64') \<in> {1..thread_count} \<and>
           is_valid_w32 s64' (Ptr (symbol_table ''echo_int_i_1'')) \<and>
           is_valid_w32 s64' (Ptr (symbol_table ''echo_int_i_2'')) \<and>
           is_valid_w32 s64' (Ptr (symbol_table ''echo_parameter_pin_1'')) \<and>
           is_valid_w32 s64' (Ptr (symbol_table ''echo_parameter_pin_2'')) \<and>
           is_valid_w32 s64' (Ptr (symbol_table ''echo_parameter_pout_1'')) \<and>
           is_valid_w32 s64' (Ptr (symbol_table ''echo_parameter_pout_2'')) \<and>
           is_valid_w8 s64' (Ptr (symbol_table ''echo_char_i_1'')) \<and>
           is_valid_w8 s64' (Ptr (symbol_table ''echo_char_i_2'')) \<and>
           is_valid_w8 s64' (Ptr (symbol_table ''increment_char_x_1'')) \<and>
           is_valid_w8 s64' (Ptr (symbol_table ''increment_char_x_2'')) \<and>
           is_valid_w32 s64' (Ptr (symbol_table ''increment_parameter_x_1'')) \<and>
           is_valid_w32 s64' (Ptr (symbol_table ''increment_parameter_x_2'')) \<and>
           is_valid_w64 s64' (Ptr (symbol_table ''increment_64_x_1'')) \<and>
           is_valid_w64 s64' (Ptr (symbol_table ''increment_64_x_2'')) \<and>
           ipc_buffer_valid s64'\<rbrace>
    RPCTo__run_internal' first65' info66'
  \<lbrace>\<lambda>_ s64'. globals_frame_intact s64' \<and>
           tls_valid s64' \<and>
           thread_index_C (tls s64') \<in> {1..thread_count} \<and>
           is_valid_w32 s64' (Ptr (symbol_table ''echo_int_i_1'')) \<and>
           is_valid_w32 s64' (Ptr (symbol_table ''echo_int_i_2'')) \<and>
           is_valid_w32 s64' (Ptr (symbol_table ''echo_parameter_pin_1'')) \<and>
           is_valid_w32 s64' (Ptr (symbol_table ''echo_parameter_pin_2'')) \<and>
           is_valid_w32 s64' (Ptr (symbol_table ''echo_parameter_pout_1'')) \<and>
           is_valid_w32 s64' (Ptr (symbol_table ''echo_parameter_pout_2'')) \<and>
           is_valid_w8 s64' (Ptr (symbol_table ''echo_char_i_1'')) \<and>
           is_valid_w8 s64' (Ptr (symbol_table ''echo_char_i_2'')) \<and>
           is_valid_w8 s64' (Ptr (symbol_table ''increment_char_x_1'')) \<and>
           is_valid_w8 s64' (Ptr (symbol_table ''increment_char_x_2'')) \<and>
           is_valid_w32 s64' (Ptr (symbol_table ''increment_parameter_x_1'')) \<and>
           is_valid_w32 s64' (Ptr (symbol_table ''increment_parameter_x_2'')) \<and>
           is_valid_w64 s64' (Ptr (symbol_table ''increment_64_x_1'')) \<and>
           is_valid_w64 s64' (Ptr (symbol_table ''increment_64_x_2'')) \<and>
           ipc_buffer_valid s64'\<rbrace>!" apply (simp add:RPCTo__run_internal'_def) apply wp apply (wp seL4_ReplyWait_wp) apply (simp add:seL4_MessageInfo_new'_def) apply wp apply (wp echo_int_internal_wp) apply (wp seL4_ReplyWait_wp) apply (simp add:seL4_MessageInfo_new'_def) apply wp apply (wp echo_parameter_internal_wp) apply (wp seL4_ReplyWait_wp) apply (simp add:seL4_MessageInfo_new'_def) apply wp apply (wp echo_char_internal_wp) apply (wp seL4_ReplyWait_wp) apply (simp add:seL4_MessageInfo_new'_def) apply wp apply (wp increment_char_internal_wp) apply (wp seL4_ReplyWait_wp) apply (simp add:seL4_MessageInfo_new'_def) apply wp apply (wp increment_parameter_internal_wp) apply (wp seL4_ReplyWait_wp) apply (simp add:seL4_MessageInfo_new'_def) apply wp apply (wp increment_64_internal_wp) apply (wp seL4_Wait_wp)+ apply (clarsimp simp:globals_frame_intact_def ipc_buffer_valid_def
    tls_valid_def tls_def tls_ptr_def ucast_id seL4_GetIPCBuffer'_def
    thread_count_def setMR_def setMRs_def update_global_w32_def
    update_global_w8_def update_global_w64_def update_global_w64_high_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s64'. globals_frame_intact s64' \<and> tls_valid s64' \<and> thread_index_C (tls s64') \<in> {1..thread_count} \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s64'\<rbrace> RPCTo__run_internal' first65' info66' \<lbrace>\<lambda>_ s64'. globals_frame_intact s64' \<and> tls_valid s64' \<and> thread_index_C (tls s64') \<in> {1..thread_count} \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s64'\<rbrace>! proof (prove)
goal (1 subgoal):
 1. \<lbrace>\<lambda>s64'. globals_frame_intact s64' \<and> tls_valid s64' \<and> 1 \<le> thread_index_C (tls s64') \<and> thread_index_C (tls s64') \<le> thread_count \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s64'\<rbrace> do ret' <- condition (\<lambda>s. first65' \<noteq> 0)
  (seL4_Wait' 6 NULL)
  (return info66');
ret'a <- seL4_GetMR' 0;
condition (\<lambda>s. ret'a = 0)
  (do ret' <- echo_int_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 1)
  (do ret' <- echo_parameter_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 2)
  (do ret' <- echo_char_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 3)
  (do ret' <- increment_char_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 4)
  (do ret' <- increment_parameter_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 5)
  (do ret' <- increment_64_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  (return ret')
od \<lbrace>\<lambda>_ s64'. globals_frame_intact s64' \<and> tls_valid s64' \<and> 1 \<le> thread_index_C (tls s64') \<and> thread_index_C (tls s64') \<le> thread_count \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s64'\<rbrace>! proof (prove)
goal (7 subgoals):
 1. \<And>ret' ret'a x ret'b. \<lbrace>?B22 ret' ret'a x ret'b\<rbrace> seL4_ReplyWait' 6 ret'b NULL \<lbrace>\<lambda>ret'c a. globals_frame_intact a \<and> tls_valid a \<and> 1 \<le> thread_index_C (tls a) \<and> thread_index_C (tls a) \<le> thread_count \<and> is_valid_w32 a (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 a (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 a (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 a (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 a (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 a (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 a (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 a (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 a (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 a (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 a (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 a (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 a (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 a (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid a\<rbrace>!
 2. \<And>ret' ret'a x. \<lbrace>?B21 ret' ret'a x\<rbrace> seL4_MessageInfo_new' 0 0 0 x \<lbrace>?B22 ret' ret'a x\<rbrace>!
 3. \<And>ret' ret'a. \<lbrace>?Q20 ret' ret'a\<rbrace> echo_int_internal' \<lbrace>?B21 ret' ret'a\<rbrace>!
 4. \<And>ret' ret'a. \<lbrace>?R20 ret' ret'a\<rbrace> condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 1)
  (do ret' <- echo_parameter_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 2)
  (do ret' <- echo_char_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 3)
  (do ret' <- increment_char_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 4)
  (do ret' <- increment_parameter_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 5)
  (do ret' <- increment_64_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  (return ret') \<lbrace>\<lambda>_ s64'. globals_frame_intact s64' \<and> tls_valid s64' \<and> 1 \<le> thread_index_C (tls s64') \<and> thread_index_C (tls s64') \<le> thread_count \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s64'\<rbrace>!
 5. \<And>ret'. \<lbrace>?B18 ret'\<rbrace> seL4_GetMR' 0 \<lbrace>\<lambda>ret'a s. if ret'a = 0 then ?Q20 ret' ret'a s else ?R20 ret' ret'a s\<rbrace>!
 6. \<lbrace>?Q17\<rbrace> condition (\<lambda>s. first65' \<noteq> 0)
  (seL4_Wait' 6 NULL)
  (return info66') \<lbrace>?B18\<rbrace>!
 7. \<And>s. globals_frame_intact s \<and> tls_valid s \<and> 1 \<le> thread_index_C (tls s) \<and> thread_index_C (tls s) \<le> thread_count \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s \<Longrightarrow> ?Q17 s proof (prove)
goal (6 subgoals):
 1. \<And>ret' ret'a x. \<lbrace>?B21 ret' ret'a x\<rbrace> seL4_MessageInfo_new' 0 0 0 x \<lbrace>\<lambda>ret'b s. globals_frame_intact s \<and> ipc_buffer_valid s \<and> (\<forall>x v0 v1 v2 v3. globals_frame_intact (setMRs s v0 v1 v2 v3) \<and> tls_valid (setMRs s v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs s v0 v1 v2 v3))\<rbrace>!
 2. \<And>ret' ret'a. \<lbrace>?Q20 ret' ret'a\<rbrace> echo_int_internal' \<lbrace>?B21 ret' ret'a\<rbrace>!
 3. \<And>ret' ret'a. \<lbrace>?R20 ret' ret'a\<rbrace> condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 1)
  (do ret' <- echo_parameter_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 2)
  (do ret' <- echo_char_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 3)
  (do ret' <- increment_char_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 4)
  (do ret' <- increment_parameter_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 5)
  (do ret' <- increment_64_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  (return ret') \<lbrace>\<lambda>_ s64'. globals_frame_intact s64' \<and> tls_valid s64' \<and> 1 \<le> thread_index_C (tls s64') \<and> thread_index_C (tls s64') \<le> thread_count \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s64'\<rbrace>!
 4. \<And>ret'. \<lbrace>?B18 ret'\<rbrace> seL4_GetMR' 0 \<lbrace>\<lambda>ret'a s. if ret'a = 0 then ?Q20 ret' ret'a s else ?R20 ret' ret'a s\<rbrace>!
 5. \<lbrace>?Q17\<rbrace> condition (\<lambda>s. first65' \<noteq> 0)
  (seL4_Wait' 6 NULL)
  (return info66') \<lbrace>?B18\<rbrace>!
 6. \<And>s. globals_frame_intact s \<and> tls_valid s \<and> 1 \<le> thread_index_C (tls s) \<and> thread_index_C (tls s) \<le> thread_count \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s \<Longrightarrow> ?Q17 s proof (prove)
goal (6 subgoals):
 1. \<And>ret' ret'a x. \<lbrace>?B21 ret' ret'a x\<rbrace> do seL4_MessageInfo___struct_seL4_MessageInfo_C <- unknown;
return (seL4_MessageInfo_C.words_C_update (\<lambda>xa. Arrays.update (seL4_MessageInfo_C.words_C seL4_MessageInfo___struct_seL4_MessageInfo_C) 0 (x && 0x7F)) seL4_MessageInfo___struct_seL4_MessageInfo_C)
od \<lbrace>\<lambda>ret'b s. globals_frame_intact s \<and> ipc_buffer_valid s \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs s v0 v1 v2 v3) \<and> tls_valid (setMRs s v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs s v0 v1 v2 v3))\<rbrace>!
 2. \<And>ret' ret'a. \<lbrace>?Q20 ret' ret'a\<rbrace> echo_int_internal' \<lbrace>?B21 ret' ret'a\<rbrace>!
 3. \<And>ret' ret'a. \<lbrace>?R20 ret' ret'a\<rbrace> condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 1)
  (do ret' <- echo_parameter_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 2)
  (do ret' <- echo_char_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 3)
  (do ret' <- increment_char_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 4)
  (do ret' <- increment_parameter_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 5)
  (do ret' <- increment_64_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  (return ret') \<lbrace>\<lambda>_ s64'. globals_frame_intact s64' \<and> tls_valid s64' \<and> 1 \<le> thread_index_C (tls s64') \<and> thread_index_C (tls s64') \<le> thread_count \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s64'\<rbrace>!
 4. \<And>ret'. \<lbrace>?B18 ret'\<rbrace> seL4_GetMR' 0 \<lbrace>\<lambda>ret'a s. if ret'a = 0 then ?Q20 ret' ret'a s else ?R20 ret' ret'a s\<rbrace>!
 5. \<lbrace>?Q17\<rbrace> condition (\<lambda>s. first65' \<noteq> 0)
  (seL4_Wait' 6 NULL)
  (return info66') \<lbrace>?B18\<rbrace>!
 6. \<And>s. globals_frame_intact s \<and> tls_valid s \<and> 1 \<le> thread_index_C (tls s) \<and> thread_index_C (tls s) \<le> thread_count \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s \<Longrightarrow> ?Q17 s proof (prove)
goal (5 subgoals):
 1. \<And>ret' ret'a. \<lbrace>?Q20 ret' ret'a\<rbrace> echo_int_internal' \<lbrace>\<lambda>x s. \<forall>x. globals_frame_intact s \<and> ipc_buffer_valid s \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs s v0 v1 v2 v3) \<and> tls_valid (setMRs s v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs s v0 v1 v2 v3))\<rbrace>!
 2. \<And>ret' ret'a. \<lbrace>?R20 ret' ret'a\<rbrace> condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 1)
  (do ret' <- echo_parameter_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 2)
  (do ret' <- echo_char_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 3)
  (do ret' <- increment_char_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 4)
  (do ret' <- increment_parameter_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 5)
  (do ret' <- increment_64_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  (return ret') \<lbrace>\<lambda>_ s64'. globals_frame_intact s64' \<and> tls_valid s64' \<and> 1 \<le> thread_index_C (tls s64') \<and> thread_index_C (tls s64') \<le> thread_count \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s64'\<rbrace>!
 3. \<And>ret'. \<lbrace>?B18 ret'\<rbrace> seL4_GetMR' 0 \<lbrace>\<lambda>ret'a s. if ret'a = 0 then ?Q20 ret' ret'a s else ?R20 ret' ret'a s\<rbrace>!
 4. \<lbrace>?Q17\<rbrace> condition (\<lambda>s. first65' \<noteq> 0)
  (seL4_Wait' 6 NULL)
  (return info66') \<lbrace>?B18\<rbrace>!
 5. \<And>s. globals_frame_intact s \<and> tls_valid s \<and> 1 \<le> thread_index_C (tls s) \<and> thread_index_C (tls s) \<le> thread_count \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s \<Longrightarrow> ?Q17 s proof (prove)
goal (4 subgoals):
 1. \<And>ret' ret'a. \<lbrace>?R20 ret' ret'a\<rbrace> condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 1)
  (do ret' <- echo_parameter_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 2)
  (do ret' <- echo_char_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 3)
  (do ret' <- increment_char_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 4)
  (do ret' <- increment_parameter_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 5)
  (do ret' <- increment_64_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  (return ret') \<lbrace>\<lambda>_ s64'. globals_frame_intact s64' \<and> tls_valid s64' \<and> 1 \<le> thread_index_C (tls s64') \<and> thread_index_C (tls s64') \<le> thread_count \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s64'\<rbrace>!
 2. \<And>ret'. \<lbrace>?B18 ret'\<rbrace> seL4_GetMR' 0 \<lbrace>\<lambda>ret'a s. if ret'a = 0 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> (\<forall>x r47' i_in_value. \<forall>i_symbol\<in>{''echo_int_i_1'', ''echo_int_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> ipc_buffer_valid (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3))) else ?R20 ret' ret'a s\<rbrace>!
 3. \<lbrace>?Q17\<rbrace> condition (\<lambda>s. first65' \<noteq> 0)
  (seL4_Wait' 6 NULL)
  (return info66') \<lbrace>?B18\<rbrace>!
 4. \<And>s. globals_frame_intact s \<and> tls_valid s \<and> 1 \<le> thread_index_C (tls s) \<and> thread_index_C (tls s) \<le> thread_count \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s \<Longrightarrow> ?Q17 s proof (prove)
goal (6 subgoals):
 1. \<And>ret' ret'a x. \<lbrace>?B38 ret' ret'a x\<rbrace> seL4_MessageInfo_new' 0 0 0 x \<lbrace>\<lambda>ret'b s. globals_frame_intact s \<and> ipc_buffer_valid s \<and> (\<forall>x v0 v1 v2 v3. globals_frame_intact (setMRs s v0 v1 v2 v3) \<and> tls_valid (setMRs s v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs s v0 v1 v2 v3))\<rbrace>!
 2. \<And>ret' ret'a. \<lbrace>?Q37 ret' ret'a\<rbrace> echo_parameter_internal' \<lbrace>?B38 ret' ret'a\<rbrace>!
 3. \<And>ret' ret'a. \<lbrace>?R37 ret' ret'a\<rbrace> condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 2)
  (do ret' <- echo_char_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 3)
  (do ret' <- increment_char_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 4)
  (do ret' <- increment_parameter_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 5)
  (do ret' <- increment_64_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  (return ret') \<lbrace>\<lambda>_ s64'. globals_frame_intact s64' \<and> tls_valid s64' \<and> 1 \<le> thread_index_C (tls s64') \<and> thread_index_C (tls s64') \<le> thread_count \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s64'\<rbrace>!
 4. \<And>ret'. \<lbrace>?B18 ret'\<rbrace> seL4_GetMR' 0 \<lbrace>\<lambda>ret'a s. if ret'a = 0 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> (\<forall>x r47' i_in_value. \<forall>i_symbol\<in>{''echo_int_i_1'', ''echo_int_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> ipc_buffer_valid (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 1 then ?Q37 ret' ret'a s else ?R37 ret' ret'a s\<rbrace>!
 5. \<lbrace>?Q17\<rbrace> condition (\<lambda>s. first65' \<noteq> 0)
  (seL4_Wait' 6 NULL)
  (return info66') \<lbrace>?B18\<rbrace>!
 6. \<And>s. globals_frame_intact s \<and> tls_valid s \<and> 1 \<le> thread_index_C (tls s) \<and> thread_index_C (tls s) \<le> thread_count \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s \<Longrightarrow> ?Q17 s proof (prove)
goal (6 subgoals):
 1. \<And>ret' ret'a x. \<lbrace>?B38 ret' ret'a x\<rbrace> do seL4_MessageInfo___struct_seL4_MessageInfo_C <- unknown;
return (seL4_MessageInfo_C.words_C_update (\<lambda>xa. Arrays.update (seL4_MessageInfo_C.words_C seL4_MessageInfo___struct_seL4_MessageInfo_C) 0 (x && 0x7F)) seL4_MessageInfo___struct_seL4_MessageInfo_C)
od \<lbrace>\<lambda>ret'b s. globals_frame_intact s \<and> ipc_buffer_valid s \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs s v0 v1 v2 v3) \<and> tls_valid (setMRs s v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs s v0 v1 v2 v3))\<rbrace>!
 2. \<And>ret' ret'a. \<lbrace>?Q37 ret' ret'a\<rbrace> echo_parameter_internal' \<lbrace>?B38 ret' ret'a\<rbrace>!
 3. \<And>ret' ret'a. \<lbrace>?R37 ret' ret'a\<rbrace> condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 2)
  (do ret' <- echo_char_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 3)
  (do ret' <- increment_char_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 4)
  (do ret' <- increment_parameter_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 5)
  (do ret' <- increment_64_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  (return ret') \<lbrace>\<lambda>_ s64'. globals_frame_intact s64' \<and> tls_valid s64' \<and> 1 \<le> thread_index_C (tls s64') \<and> thread_index_C (tls s64') \<le> thread_count \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s64'\<rbrace>!
 4. \<And>ret'. \<lbrace>?B18 ret'\<rbrace> seL4_GetMR' 0 \<lbrace>\<lambda>ret'a s. if ret'a = 0 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> (\<forall>x r47' i_in_value. \<forall>i_symbol\<in>{''echo_int_i_1'', ''echo_int_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> ipc_buffer_valid (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 1 then ?Q37 ret' ret'a s else ?R37 ret' ret'a s\<rbrace>!
 5. \<lbrace>?Q17\<rbrace> condition (\<lambda>s. first65' \<noteq> 0)
  (seL4_Wait' 6 NULL)
  (return info66') \<lbrace>?B18\<rbrace>!
 6. \<And>s. globals_frame_intact s \<and> tls_valid s \<and> 1 \<le> thread_index_C (tls s) \<and> thread_index_C (tls s) \<le> thread_count \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s \<Longrightarrow> ?Q17 s proof (prove)
goal (5 subgoals):
 1. \<And>ret' ret'a. \<lbrace>?Q37 ret' ret'a\<rbrace> echo_parameter_internal' \<lbrace>\<lambda>x s. \<forall>x. globals_frame_intact s \<and> ipc_buffer_valid s \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs s v0 v1 v2 v3) \<and> tls_valid (setMRs s v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs s v0 v1 v2 v3))\<rbrace>!
 2. \<And>ret' ret'a. \<lbrace>?R37 ret' ret'a\<rbrace> condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 2)
  (do ret' <- echo_char_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 3)
  (do ret' <- increment_char_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 4)
  (do ret' <- increment_parameter_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 5)
  (do ret' <- increment_64_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  (return ret') \<lbrace>\<lambda>_ s64'. globals_frame_intact s64' \<and> tls_valid s64' \<and> 1 \<le> thread_index_C (tls s64') \<and> thread_index_C (tls s64') \<le> thread_count \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s64'\<rbrace>!
 3. \<And>ret'. \<lbrace>?B18 ret'\<rbrace> seL4_GetMR' 0 \<lbrace>\<lambda>ret'a s. if ret'a = 0 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> (\<forall>x r47' i_in_value. \<forall>i_symbol\<in>{''echo_int_i_1'', ''echo_int_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> ipc_buffer_valid (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 1 then ?Q37 ret' ret'a s else ?R37 ret' ret'a s\<rbrace>!
 4. \<lbrace>?Q17\<rbrace> condition (\<lambda>s. first65' \<noteq> 0)
  (seL4_Wait' 6 NULL)
  (return info66') \<lbrace>?B18\<rbrace>!
 5. \<And>s. globals_frame_intact s \<and> tls_valid s \<and> 1 \<le> thread_index_C (tls s) \<and> thread_index_C (tls s) \<le> thread_count \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s \<Longrightarrow> ?Q17 s proof (prove)
goal (4 subgoals):
 1. \<And>ret' ret'a. \<lbrace>?R37 ret' ret'a\<rbrace> condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 2)
  (do ret' <- echo_char_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 3)
  (do ret' <- increment_char_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 4)
  (do ret' <- increment_parameter_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 5)
  (do ret' <- increment_64_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  (return ret') \<lbrace>\<lambda>_ s64'. globals_frame_intact s64' \<and> tls_valid s64' \<and> 1 \<le> thread_index_C (tls s64') \<and> thread_index_C (tls s64') \<le> thread_count \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s64'\<rbrace>!
 2. \<And>ret'. \<lbrace>?B18 ret'\<rbrace> seL4_GetMR' 0 \<lbrace>\<lambda>ret'a s. if ret'a = 0 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> (\<forall>x r47' i_in_value. \<forall>i_symbol\<in>{''echo_int_i_1'', ''echo_int_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> ipc_buffer_valid (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 1 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> (\<forall>x r50' pin_in_value pout_out_value. \<forall>pin_symbol\<in>{''echo_parameter_pin_1'', ''echo_parameter_pin_2''}. \<forall>pout_symbol\<in>{''echo_parameter_pout_1'', ''echo_parameter_pout_2''}. \<forall>x. globals_frame_intact (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> ipc_buffer_valid (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3))) else ?R37 ret' ret'a s\<rbrace>!
 3. \<lbrace>?Q17\<rbrace> condition (\<lambda>s. first65' \<noteq> 0)
  (seL4_Wait' 6 NULL)
  (return info66') \<lbrace>?B18\<rbrace>!
 4. \<And>s. globals_frame_intact s \<and> tls_valid s \<and> 1 \<le> thread_index_C (tls s) \<and> thread_index_C (tls s) \<le> thread_count \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s \<Longrightarrow> ?Q17 s proof (prove)
goal (6 subgoals):
 1. \<And>ret' ret'a x. \<lbrace>?B54 ret' ret'a x\<rbrace> seL4_MessageInfo_new' 0 0 0 x \<lbrace>\<lambda>ret'b s. globals_frame_intact s \<and> ipc_buffer_valid s \<and> (\<forall>x v0 v1 v2 v3. globals_frame_intact (setMRs s v0 v1 v2 v3) \<and> tls_valid (setMRs s v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs s v0 v1 v2 v3))\<rbrace>!
 2. \<And>ret' ret'a. \<lbrace>?Q53 ret' ret'a\<rbrace> echo_char_internal' \<lbrace>?B54 ret' ret'a\<rbrace>!
 3. \<And>ret' ret'a. \<lbrace>?R53 ret' ret'a\<rbrace> condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 3)
  (do ret' <- increment_char_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 4)
  (do ret' <- increment_parameter_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 5)
  (do ret' <- increment_64_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  (return ret') \<lbrace>\<lambda>_ s64'. globals_frame_intact s64' \<and> tls_valid s64' \<and> 1 \<le> thread_index_C (tls s64') \<and> thread_index_C (tls s64') \<le> thread_count \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s64'\<rbrace>!
 4. \<And>ret'. \<lbrace>?B18 ret'\<rbrace> seL4_GetMR' 0 \<lbrace>\<lambda>ret'a s. if ret'a = 0 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> (\<forall>x r47' i_in_value. \<forall>i_symbol\<in>{''echo_int_i_1'', ''echo_int_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> ipc_buffer_valid (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 1 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> (\<forall>x r50' pin_in_value pout_out_value. \<forall>pin_symbol\<in>{''echo_parameter_pin_1'', ''echo_parameter_pin_2''}. \<forall>pout_symbol\<in>{''echo_parameter_pout_1'', ''echo_parameter_pout_2''}. \<forall>x. globals_frame_intact (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> ipc_buffer_valid (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 2 then ?Q53 ret' ret'a s else ?R53 ret' ret'a s\<rbrace>!
 5. \<lbrace>?Q17\<rbrace> condition (\<lambda>s. first65' \<noteq> 0)
  (seL4_Wait' 6 NULL)
  (return info66') \<lbrace>?B18\<rbrace>!
 6. \<And>s. globals_frame_intact s \<and> tls_valid s \<and> 1 \<le> thread_index_C (tls s) \<and> thread_index_C (tls s) \<le> thread_count \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s \<Longrightarrow> ?Q17 s proof (prove)
goal (6 subgoals):
 1. \<And>ret' ret'a x. \<lbrace>?B54 ret' ret'a x\<rbrace> do seL4_MessageInfo___struct_seL4_MessageInfo_C <- unknown;
return (seL4_MessageInfo_C.words_C_update (\<lambda>xa. Arrays.update (seL4_MessageInfo_C.words_C seL4_MessageInfo___struct_seL4_MessageInfo_C) 0 (x && 0x7F)) seL4_MessageInfo___struct_seL4_MessageInfo_C)
od \<lbrace>\<lambda>ret'b s. globals_frame_intact s \<and> ipc_buffer_valid s \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs s v0 v1 v2 v3) \<and> tls_valid (setMRs s v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs s v0 v1 v2 v3))\<rbrace>!
 2. \<And>ret' ret'a. \<lbrace>?Q53 ret' ret'a\<rbrace> echo_char_internal' \<lbrace>?B54 ret' ret'a\<rbrace>!
 3. \<And>ret' ret'a. \<lbrace>?R53 ret' ret'a\<rbrace> condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 3)
  (do ret' <- increment_char_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 4)
  (do ret' <- increment_parameter_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 5)
  (do ret' <- increment_64_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  (return ret') \<lbrace>\<lambda>_ s64'. globals_frame_intact s64' \<and> tls_valid s64' \<and> 1 \<le> thread_index_C (tls s64') \<and> thread_index_C (tls s64') \<le> thread_count \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s64'\<rbrace>!
 4. \<And>ret'. \<lbrace>?B18 ret'\<rbrace> seL4_GetMR' 0 \<lbrace>\<lambda>ret'a s. if ret'a = 0 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> (\<forall>x r47' i_in_value. \<forall>i_symbol\<in>{''echo_int_i_1'', ''echo_int_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> ipc_buffer_valid (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 1 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> (\<forall>x r50' pin_in_value pout_out_value. \<forall>pin_symbol\<in>{''echo_parameter_pin_1'', ''echo_parameter_pin_2''}. \<forall>pout_symbol\<in>{''echo_parameter_pout_1'', ''echo_parameter_pout_2''}. \<forall>x. globals_frame_intact (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> ipc_buffer_valid (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 2 then ?Q53 ret' ret'a s else ?R53 ret' ret'a s\<rbrace>!
 5. \<lbrace>?Q17\<rbrace> condition (\<lambda>s. first65' \<noteq> 0)
  (seL4_Wait' 6 NULL)
  (return info66') \<lbrace>?B18\<rbrace>!
 6. \<And>s. globals_frame_intact s \<and> tls_valid s \<and> 1 \<le> thread_index_C (tls s) \<and> thread_index_C (tls s) \<le> thread_count \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s \<Longrightarrow> ?Q17 s proof (prove)
goal (5 subgoals):
 1. \<And>ret' ret'a. \<lbrace>?Q53 ret' ret'a\<rbrace> echo_char_internal' \<lbrace>\<lambda>x s. \<forall>x. globals_frame_intact s \<and> ipc_buffer_valid s \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs s v0 v1 v2 v3) \<and> tls_valid (setMRs s v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs s v0 v1 v2 v3))\<rbrace>!
 2. \<And>ret' ret'a. \<lbrace>?R53 ret' ret'a\<rbrace> condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 3)
  (do ret' <- increment_char_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 4)
  (do ret' <- increment_parameter_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 5)
  (do ret' <- increment_64_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  (return ret') \<lbrace>\<lambda>_ s64'. globals_frame_intact s64' \<and> tls_valid s64' \<and> 1 \<le> thread_index_C (tls s64') \<and> thread_index_C (tls s64') \<le> thread_count \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s64'\<rbrace>!
 3. \<And>ret'. \<lbrace>?B18 ret'\<rbrace> seL4_GetMR' 0 \<lbrace>\<lambda>ret'a s. if ret'a = 0 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> (\<forall>x r47' i_in_value. \<forall>i_symbol\<in>{''echo_int_i_1'', ''echo_int_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> ipc_buffer_valid (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 1 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> (\<forall>x r50' pin_in_value pout_out_value. \<forall>pin_symbol\<in>{''echo_parameter_pin_1'', ''echo_parameter_pin_2''}. \<forall>pout_symbol\<in>{''echo_parameter_pout_1'', ''echo_parameter_pout_2''}. \<forall>x. globals_frame_intact (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> ipc_buffer_valid (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 2 then ?Q53 ret' ret'a s else ?R53 ret' ret'a s\<rbrace>!
 4. \<lbrace>?Q17\<rbrace> condition (\<lambda>s. first65' \<noteq> 0)
  (seL4_Wait' 6 NULL)
  (return info66') \<lbrace>?B18\<rbrace>!
 5. \<And>s. globals_frame_intact s \<and> tls_valid s \<and> 1 \<le> thread_index_C (tls s) \<and> thread_index_C (tls s) \<le> thread_count \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s \<Longrightarrow> ?Q17 s proof (prove)
goal (4 subgoals):
 1. \<And>ret' ret'a. \<lbrace>?R53 ret' ret'a\<rbrace> condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 3)
  (do ret' <- increment_char_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 4)
  (do ret' <- increment_parameter_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 5)
  (do ret' <- increment_64_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  (return ret') \<lbrace>\<lambda>_ s64'. globals_frame_intact s64' \<and> tls_valid s64' \<and> 1 \<le> thread_index_C (tls s64') \<and> thread_index_C (tls s64') \<le> thread_count \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s64'\<rbrace>!
 2. \<And>ret'. \<lbrace>?B18 ret'\<rbrace> seL4_GetMR' 0 \<lbrace>\<lambda>ret'a s. if ret'a = 0 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> (\<forall>x r47' i_in_value. \<forall>i_symbol\<in>{''echo_int_i_1'', ''echo_int_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> ipc_buffer_valid (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 1 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> (\<forall>x r50' pin_in_value pout_out_value. \<forall>pin_symbol\<in>{''echo_parameter_pin_1'', ''echo_parameter_pin_2''}. \<forall>pout_symbol\<in>{''echo_parameter_pout_1'', ''echo_parameter_pout_2''}. \<forall>x. globals_frame_intact (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> ipc_buffer_valid (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 2 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> (\<forall>x r53' i_in_value. \<forall>i_symbol\<in>{''echo_char_i_1'', ''echo_char_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') \<and> ipc_buffer_valid (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3))) else ?R53 ret' ret'a s\<rbrace>!
 3. \<lbrace>?Q17\<rbrace> condition (\<lambda>s. first65' \<noteq> 0)
  (seL4_Wait' 6 NULL)
  (return info66') \<lbrace>?B18\<rbrace>!
 4. \<And>s. globals_frame_intact s \<and> tls_valid s \<and> 1 \<le> thread_index_C (tls s) \<and> thread_index_C (tls s) \<le> thread_count \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s \<Longrightarrow> ?Q17 s proof (prove)
goal (6 subgoals):
 1. \<And>ret' ret'a x. \<lbrace>?B70 ret' ret'a x\<rbrace> seL4_MessageInfo_new' 0 0 0 x \<lbrace>\<lambda>ret'b s. globals_frame_intact s \<and> ipc_buffer_valid s \<and> (\<forall>x v0 v1 v2 v3. globals_frame_intact (setMRs s v0 v1 v2 v3) \<and> tls_valid (setMRs s v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs s v0 v1 v2 v3))\<rbrace>!
 2. \<And>ret' ret'a. \<lbrace>?Q69 ret' ret'a\<rbrace> increment_char_internal' \<lbrace>?B70 ret' ret'a\<rbrace>!
 3. \<And>ret' ret'a. \<lbrace>?R69 ret' ret'a\<rbrace> condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 4)
  (do ret' <- increment_parameter_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 5)
  (do ret' <- increment_64_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  (return ret') \<lbrace>\<lambda>_ s64'. globals_frame_intact s64' \<and> tls_valid s64' \<and> 1 \<le> thread_index_C (tls s64') \<and> thread_index_C (tls s64') \<le> thread_count \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s64'\<rbrace>!
 4. \<And>ret'. \<lbrace>?B18 ret'\<rbrace> seL4_GetMR' 0 \<lbrace>\<lambda>ret'a s. if ret'a = 0 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> (\<forall>x r47' i_in_value. \<forall>i_symbol\<in>{''echo_int_i_1'', ''echo_int_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> ipc_buffer_valid (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 1 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> (\<forall>x r50' pin_in_value pout_out_value. \<forall>pin_symbol\<in>{''echo_parameter_pin_1'', ''echo_parameter_pin_2''}. \<forall>pout_symbol\<in>{''echo_parameter_pout_1'', ''echo_parameter_pout_2''}. \<forall>x. globals_frame_intact (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> ipc_buffer_valid (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 2 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> (\<forall>x r53' i_in_value. \<forall>i_symbol\<in>{''echo_char_i_1'', ''echo_char_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') \<and> ipc_buffer_valid (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 3 then ?Q69 ret' ret'a s else ?R69 ret' ret'a s\<rbrace>!
 5. \<lbrace>?Q17\<rbrace> condition (\<lambda>s. first65' \<noteq> 0)
  (seL4_Wait' 6 NULL)
  (return info66') \<lbrace>?B18\<rbrace>!
 6. \<And>s. globals_frame_intact s \<and> tls_valid s \<and> 1 \<le> thread_index_C (tls s) \<and> thread_index_C (tls s) \<le> thread_count \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s \<Longrightarrow> ?Q17 s proof (prove)
goal (6 subgoals):
 1. \<And>ret' ret'a x. \<lbrace>?B70 ret' ret'a x\<rbrace> do seL4_MessageInfo___struct_seL4_MessageInfo_C <- unknown;
return (seL4_MessageInfo_C.words_C_update (\<lambda>xa. Arrays.update (seL4_MessageInfo_C.words_C seL4_MessageInfo___struct_seL4_MessageInfo_C) 0 (x && 0x7F)) seL4_MessageInfo___struct_seL4_MessageInfo_C)
od \<lbrace>\<lambda>ret'b s. globals_frame_intact s \<and> ipc_buffer_valid s \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs s v0 v1 v2 v3) \<and> tls_valid (setMRs s v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs s v0 v1 v2 v3))\<rbrace>!
 2. \<And>ret' ret'a. \<lbrace>?Q69 ret' ret'a\<rbrace> increment_char_internal' \<lbrace>?B70 ret' ret'a\<rbrace>!
 3. \<And>ret' ret'a. \<lbrace>?R69 ret' ret'a\<rbrace> condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 4)
  (do ret' <- increment_parameter_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 5)
  (do ret' <- increment_64_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  (return ret') \<lbrace>\<lambda>_ s64'. globals_frame_intact s64' \<and> tls_valid s64' \<and> 1 \<le> thread_index_C (tls s64') \<and> thread_index_C (tls s64') \<le> thread_count \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s64'\<rbrace>!
 4. \<And>ret'. \<lbrace>?B18 ret'\<rbrace> seL4_GetMR' 0 \<lbrace>\<lambda>ret'a s. if ret'a = 0 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> (\<forall>x r47' i_in_value. \<forall>i_symbol\<in>{''echo_int_i_1'', ''echo_int_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> ipc_buffer_valid (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 1 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> (\<forall>x r50' pin_in_value pout_out_value. \<forall>pin_symbol\<in>{''echo_parameter_pin_1'', ''echo_parameter_pin_2''}. \<forall>pout_symbol\<in>{''echo_parameter_pout_1'', ''echo_parameter_pout_2''}. \<forall>x. globals_frame_intact (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> ipc_buffer_valid (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 2 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> (\<forall>x r53' i_in_value. \<forall>i_symbol\<in>{''echo_char_i_1'', ''echo_char_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') \<and> ipc_buffer_valid (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 3 then ?Q69 ret' ret'a s else ?R69 ret' ret'a s\<rbrace>!
 5. \<lbrace>?Q17\<rbrace> condition (\<lambda>s. first65' \<noteq> 0)
  (seL4_Wait' 6 NULL)
  (return info66') \<lbrace>?B18\<rbrace>!
 6. \<And>s. globals_frame_intact s \<and> tls_valid s \<and> 1 \<le> thread_index_C (tls s) \<and> thread_index_C (tls s) \<le> thread_count \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s \<Longrightarrow> ?Q17 s proof (prove)
goal (5 subgoals):
 1. \<And>ret' ret'a. \<lbrace>?Q69 ret' ret'a\<rbrace> increment_char_internal' \<lbrace>\<lambda>x s. \<forall>x. globals_frame_intact s \<and> ipc_buffer_valid s \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs s v0 v1 v2 v3) \<and> tls_valid (setMRs s v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs s v0 v1 v2 v3))\<rbrace>!
 2. \<And>ret' ret'a. \<lbrace>?R69 ret' ret'a\<rbrace> condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 4)
  (do ret' <- increment_parameter_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 5)
  (do ret' <- increment_64_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  (return ret') \<lbrace>\<lambda>_ s64'. globals_frame_intact s64' \<and> tls_valid s64' \<and> 1 \<le> thread_index_C (tls s64') \<and> thread_index_C (tls s64') \<le> thread_count \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s64'\<rbrace>!
 3. \<And>ret'. \<lbrace>?B18 ret'\<rbrace> seL4_GetMR' 0 \<lbrace>\<lambda>ret'a s. if ret'a = 0 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> (\<forall>x r47' i_in_value. \<forall>i_symbol\<in>{''echo_int_i_1'', ''echo_int_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> ipc_buffer_valid (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 1 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> (\<forall>x r50' pin_in_value pout_out_value. \<forall>pin_symbol\<in>{''echo_parameter_pin_1'', ''echo_parameter_pin_2''}. \<forall>pout_symbol\<in>{''echo_parameter_pout_1'', ''echo_parameter_pout_2''}. \<forall>x. globals_frame_intact (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> ipc_buffer_valid (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 2 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> (\<forall>x r53' i_in_value. \<forall>i_symbol\<in>{''echo_char_i_1'', ''echo_char_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') \<and> ipc_buffer_valid (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 3 then ?Q69 ret' ret'a s else ?R69 ret' ret'a s\<rbrace>!
 4. \<lbrace>?Q17\<rbrace> condition (\<lambda>s. first65' \<noteq> 0)
  (seL4_Wait' 6 NULL)
  (return info66') \<lbrace>?B18\<rbrace>!
 5. \<And>s. globals_frame_intact s \<and> tls_valid s \<and> 1 \<le> thread_index_C (tls s) \<and> thread_index_C (tls s) \<le> thread_count \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s \<Longrightarrow> ?Q17 s proof (prove)
goal (4 subgoals):
 1. \<And>ret' ret'a. \<lbrace>?R69 ret' ret'a\<rbrace> condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 4)
  (do ret' <- increment_parameter_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 5)
  (do ret' <- increment_64_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  (return ret') \<lbrace>\<lambda>_ s64'. globals_frame_intact s64' \<and> tls_valid s64' \<and> 1 \<le> thread_index_C (tls s64') \<and> thread_index_C (tls s64') \<le> thread_count \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s64'\<rbrace>!
 2. \<And>ret'. \<lbrace>?B18 ret'\<rbrace> seL4_GetMR' 0 \<lbrace>\<lambda>ret'a s. if ret'a = 0 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> (\<forall>x r47' i_in_value. \<forall>i_symbol\<in>{''echo_int_i_1'', ''echo_int_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> ipc_buffer_valid (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 1 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> (\<forall>x r50' pin_in_value pout_out_value. \<forall>pin_symbol\<in>{''echo_parameter_pin_1'', ''echo_parameter_pin_2''}. \<forall>pout_symbol\<in>{''echo_parameter_pout_1'', ''echo_parameter_pout_2''}. \<forall>x. globals_frame_intact (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> ipc_buffer_valid (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 2 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> (\<forall>x r53' i_in_value. \<forall>i_symbol\<in>{''echo_char_i_1'', ''echo_char_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') \<and> ipc_buffer_valid (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 3 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> (\<forall>x x_in_value x_out_value. \<forall>x_symbol\<in>{''increment_char_x_1'', ''increment_char_x_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) \<and> ipc_buffer_valid (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3))) else ?R69 ret' ret'a s\<rbrace>!
 3. \<lbrace>?Q17\<rbrace> condition (\<lambda>s. first65' \<noteq> 0)
  (seL4_Wait' 6 NULL)
  (return info66') \<lbrace>?B18\<rbrace>!
 4. \<And>s. globals_frame_intact s \<and> tls_valid s \<and> 1 \<le> thread_index_C (tls s) \<and> thread_index_C (tls s) \<le> thread_count \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s \<Longrightarrow> ?Q17 s proof (prove)
goal (6 subgoals):
 1. \<And>ret' ret'a x. \<lbrace>?B86 ret' ret'a x\<rbrace> seL4_MessageInfo_new' 0 0 0 x \<lbrace>\<lambda>ret'b s. globals_frame_intact s \<and> ipc_buffer_valid s \<and> (\<forall>x v0 v1 v2 v3. globals_frame_intact (setMRs s v0 v1 v2 v3) \<and> tls_valid (setMRs s v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs s v0 v1 v2 v3))\<rbrace>!
 2. \<And>ret' ret'a. \<lbrace>?Q85 ret' ret'a\<rbrace> increment_parameter_internal' \<lbrace>?B86 ret' ret'a\<rbrace>!
 3. \<And>ret' ret'a. \<lbrace>?R85 ret' ret'a\<rbrace> condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 5)
  (do ret' <- increment_64_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  (return ret') \<lbrace>\<lambda>_ s64'. globals_frame_intact s64' \<and> tls_valid s64' \<and> 1 \<le> thread_index_C (tls s64') \<and> thread_index_C (tls s64') \<le> thread_count \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s64'\<rbrace>!
 4. \<And>ret'. \<lbrace>?B18 ret'\<rbrace> seL4_GetMR' 0 \<lbrace>\<lambda>ret'a s. if ret'a = 0 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> (\<forall>x r47' i_in_value. \<forall>i_symbol\<in>{''echo_int_i_1'', ''echo_int_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> ipc_buffer_valid (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 1 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> (\<forall>x r50' pin_in_value pout_out_value. \<forall>pin_symbol\<in>{''echo_parameter_pin_1'', ''echo_parameter_pin_2''}. \<forall>pout_symbol\<in>{''echo_parameter_pout_1'', ''echo_parameter_pout_2''}. \<forall>x. globals_frame_intact (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> ipc_buffer_valid (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 2 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> (\<forall>x r53' i_in_value. \<forall>i_symbol\<in>{''echo_char_i_1'', ''echo_char_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') \<and> ipc_buffer_valid (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 3 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> (\<forall>x x_in_value x_out_value. \<forall>x_symbol\<in>{''increment_char_x_1'', ''increment_char_x_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) \<and> ipc_buffer_valid (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 4 then ?Q85 ret' ret'a s else ?R85 ret' ret'a s\<rbrace>!
 5. \<lbrace>?Q17\<rbrace> condition (\<lambda>s. first65' \<noteq> 0)
  (seL4_Wait' 6 NULL)
  (return info66') \<lbrace>?B18\<rbrace>!
 6. \<And>s. globals_frame_intact s \<and> tls_valid s \<and> 1 \<le> thread_index_C (tls s) \<and> thread_index_C (tls s) \<le> thread_count \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s \<Longrightarrow> ?Q17 s proof (prove)
goal (6 subgoals):
 1. \<And>ret' ret'a x. \<lbrace>?B86 ret' ret'a x\<rbrace> do seL4_MessageInfo___struct_seL4_MessageInfo_C <- unknown;
return (seL4_MessageInfo_C.words_C_update (\<lambda>xa. Arrays.update (seL4_MessageInfo_C.words_C seL4_MessageInfo___struct_seL4_MessageInfo_C) 0 (x && 0x7F)) seL4_MessageInfo___struct_seL4_MessageInfo_C)
od \<lbrace>\<lambda>ret'b s. globals_frame_intact s \<and> ipc_buffer_valid s \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs s v0 v1 v2 v3) \<and> tls_valid (setMRs s v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs s v0 v1 v2 v3))\<rbrace>!
 2. \<And>ret' ret'a. \<lbrace>?Q85 ret' ret'a\<rbrace> increment_parameter_internal' \<lbrace>?B86 ret' ret'a\<rbrace>!
 3. \<And>ret' ret'a. \<lbrace>?R85 ret' ret'a\<rbrace> condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 5)
  (do ret' <- increment_64_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  (return ret') \<lbrace>\<lambda>_ s64'. globals_frame_intact s64' \<and> tls_valid s64' \<and> 1 \<le> thread_index_C (tls s64') \<and> thread_index_C (tls s64') \<le> thread_count \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s64'\<rbrace>!
 4. \<And>ret'. \<lbrace>?B18 ret'\<rbrace> seL4_GetMR' 0 \<lbrace>\<lambda>ret'a s. if ret'a = 0 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> (\<forall>x r47' i_in_value. \<forall>i_symbol\<in>{''echo_int_i_1'', ''echo_int_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> ipc_buffer_valid (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 1 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> (\<forall>x r50' pin_in_value pout_out_value. \<forall>pin_symbol\<in>{''echo_parameter_pin_1'', ''echo_parameter_pin_2''}. \<forall>pout_symbol\<in>{''echo_parameter_pout_1'', ''echo_parameter_pout_2''}. \<forall>x. globals_frame_intact (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> ipc_buffer_valid (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 2 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> (\<forall>x r53' i_in_value. \<forall>i_symbol\<in>{''echo_char_i_1'', ''echo_char_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') \<and> ipc_buffer_valid (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 3 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> (\<forall>x x_in_value x_out_value. \<forall>x_symbol\<in>{''increment_char_x_1'', ''increment_char_x_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) \<and> ipc_buffer_valid (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 4 then ?Q85 ret' ret'a s else ?R85 ret' ret'a s\<rbrace>!
 5. \<lbrace>?Q17\<rbrace> condition (\<lambda>s. first65' \<noteq> 0)
  (seL4_Wait' 6 NULL)
  (return info66') \<lbrace>?B18\<rbrace>!
 6. \<And>s. globals_frame_intact s \<and> tls_valid s \<and> 1 \<le> thread_index_C (tls s) \<and> thread_index_C (tls s) \<le> thread_count \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s \<Longrightarrow> ?Q17 s proof (prove)
goal (5 subgoals):
 1. \<And>ret' ret'a. \<lbrace>?Q85 ret' ret'a\<rbrace> increment_parameter_internal' \<lbrace>\<lambda>x s. \<forall>x. globals_frame_intact s \<and> ipc_buffer_valid s \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs s v0 v1 v2 v3) \<and> tls_valid (setMRs s v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs s v0 v1 v2 v3))\<rbrace>!
 2. \<And>ret' ret'a. \<lbrace>?R85 ret' ret'a\<rbrace> condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 5)
  (do ret' <- increment_64_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  (return ret') \<lbrace>\<lambda>_ s64'. globals_frame_intact s64' \<and> tls_valid s64' \<and> 1 \<le> thread_index_C (tls s64') \<and> thread_index_C (tls s64') \<le> thread_count \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s64'\<rbrace>!
 3. \<And>ret'. \<lbrace>?B18 ret'\<rbrace> seL4_GetMR' 0 \<lbrace>\<lambda>ret'a s. if ret'a = 0 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> (\<forall>x r47' i_in_value. \<forall>i_symbol\<in>{''echo_int_i_1'', ''echo_int_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> ipc_buffer_valid (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 1 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> (\<forall>x r50' pin_in_value pout_out_value. \<forall>pin_symbol\<in>{''echo_parameter_pin_1'', ''echo_parameter_pin_2''}. \<forall>pout_symbol\<in>{''echo_parameter_pout_1'', ''echo_parameter_pout_2''}. \<forall>x. globals_frame_intact (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> ipc_buffer_valid (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 2 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> (\<forall>x r53' i_in_value. \<forall>i_symbol\<in>{''echo_char_i_1'', ''echo_char_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') \<and> ipc_buffer_valid (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 3 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> (\<forall>x x_in_value x_out_value. \<forall>x_symbol\<in>{''increment_char_x_1'', ''increment_char_x_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) \<and> ipc_buffer_valid (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 4 then ?Q85 ret' ret'a s else ?R85 ret' ret'a s\<rbrace>!
 4. \<lbrace>?Q17\<rbrace> condition (\<lambda>s. first65' \<noteq> 0)
  (seL4_Wait' 6 NULL)
  (return info66') \<lbrace>?B18\<rbrace>!
 5. \<And>s. globals_frame_intact s \<and> tls_valid s \<and> 1 \<le> thread_index_C (tls s) \<and> thread_index_C (tls s) \<le> thread_count \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s \<Longrightarrow> ?Q17 s proof (prove)
goal (4 subgoals):
 1. \<And>ret' ret'a. \<lbrace>?R85 ret' ret'a\<rbrace> condition (\<lambda>s. sint (ucast_32_to_s32 ret'a) = 5)
  (do ret' <- increment_64_internal';
ret' <- seL4_MessageInfo_new' 0 0 0 ret';
ret'a <- seL4_ReplyWait' 6 ret' NULL;
return ret'
od)
  (return ret') \<lbrace>\<lambda>_ s64'. globals_frame_intact s64' \<and> tls_valid s64' \<and> 1 \<le> thread_index_C (tls s64') \<and> thread_index_C (tls s64') \<le> thread_count \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s64'\<rbrace>!
 2. \<And>ret'. \<lbrace>?B18 ret'\<rbrace> seL4_GetMR' 0 \<lbrace>\<lambda>ret'a s. if ret'a = 0 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> (\<forall>x r47' i_in_value. \<forall>i_symbol\<in>{''echo_int_i_1'', ''echo_int_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> ipc_buffer_valid (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 1 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> (\<forall>x r50' pin_in_value pout_out_value. \<forall>pin_symbol\<in>{''echo_parameter_pin_1'', ''echo_parameter_pin_2''}. \<forall>pout_symbol\<in>{''echo_parameter_pout_1'', ''echo_parameter_pout_2''}. \<forall>x. globals_frame_intact (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> ipc_buffer_valid (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 2 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> (\<forall>x r53' i_in_value. \<forall>i_symbol\<in>{''echo_char_i_1'', ''echo_char_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') \<and> ipc_buffer_valid (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 3 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> (\<forall>x x_in_value x_out_value. \<forall>x_symbol\<in>{''increment_char_x_1'', ''increment_char_x_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) \<and> ipc_buffer_valid (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 4 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> (\<forall>x x_in_value x_out_value. \<forall>x_symbol\<in>{''increment_parameter_x_1'', ''increment_parameter_x_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) \<and> ipc_buffer_valid (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3))) else ?R85 ret' ret'a s\<rbrace>!
 3. \<lbrace>?Q17\<rbrace> condition (\<lambda>s. first65' \<noteq> 0)
  (seL4_Wait' 6 NULL)
  (return info66') \<lbrace>?B18\<rbrace>!
 4. \<And>s. globals_frame_intact s \<and> tls_valid s \<and> 1 \<le> thread_index_C (tls s) \<and> thread_index_C (tls s) \<le> thread_count \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s \<Longrightarrow> ?Q17 s proof (prove)
goal (6 subgoals):
 1. \<And>ret' ret'a x. \<lbrace>?B102 ret' ret'a x\<rbrace> seL4_MessageInfo_new' 0 0 0 x \<lbrace>\<lambda>ret'b s. globals_frame_intact s \<and> ipc_buffer_valid s \<and> (\<forall>x v0 v1 v2 v3. globals_frame_intact (setMRs s v0 v1 v2 v3) \<and> tls_valid (setMRs s v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs s v0 v1 v2 v3))\<rbrace>!
 2. \<And>ret' ret'a. \<lbrace>?Q101 ret' ret'a\<rbrace> increment_64_internal' \<lbrace>?B102 ret' ret'a\<rbrace>!
 3. \<And>ret' ret'a. \<lbrace>?R101 ret' ret'a\<rbrace> return ret' \<lbrace>\<lambda>_ s64'. globals_frame_intact s64' \<and> tls_valid s64' \<and> 1 \<le> thread_index_C (tls s64') \<and> thread_index_C (tls s64') \<le> thread_count \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s64'\<rbrace>!
 4. \<And>ret'. \<lbrace>?B18 ret'\<rbrace> seL4_GetMR' 0 \<lbrace>\<lambda>ret'a s. if ret'a = 0 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> (\<forall>x r47' i_in_value. \<forall>i_symbol\<in>{''echo_int_i_1'', ''echo_int_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> ipc_buffer_valid (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 1 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> (\<forall>x r50' pin_in_value pout_out_value. \<forall>pin_symbol\<in>{''echo_parameter_pin_1'', ''echo_parameter_pin_2''}. \<forall>pout_symbol\<in>{''echo_parameter_pout_1'', ''echo_parameter_pout_2''}. \<forall>x. globals_frame_intact (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> ipc_buffer_valid (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 2 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> (\<forall>x r53' i_in_value. \<forall>i_symbol\<in>{''echo_char_i_1'', ''echo_char_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') \<and> ipc_buffer_valid (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 3 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> (\<forall>x x_in_value x_out_value. \<forall>x_symbol\<in>{''increment_char_x_1'', ''increment_char_x_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) \<and> ipc_buffer_valid (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 4 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> (\<forall>x x_in_value x_out_value. \<forall>x_symbol\<in>{''increment_parameter_x_1'', ''increment_parameter_x_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) \<and> ipc_buffer_valid (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 5 then ?Q101 ret' ret'a s else ?R101 ret' ret'a s\<rbrace>!
 5. \<lbrace>?Q17\<rbrace> condition (\<lambda>s. first65' \<noteq> 0)
  (seL4_Wait' 6 NULL)
  (return info66') \<lbrace>?B18\<rbrace>!
 6. \<And>s. globals_frame_intact s \<and> tls_valid s \<and> 1 \<le> thread_index_C (tls s) \<and> thread_index_C (tls s) \<le> thread_count \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s \<Longrightarrow> ?Q17 s proof (prove)
goal (6 subgoals):
 1. \<And>ret' ret'a x. \<lbrace>?B102 ret' ret'a x\<rbrace> do seL4_MessageInfo___struct_seL4_MessageInfo_C <- unknown;
return (seL4_MessageInfo_C.words_C_update (\<lambda>xa. Arrays.update (seL4_MessageInfo_C.words_C seL4_MessageInfo___struct_seL4_MessageInfo_C) 0 (x && 0x7F)) seL4_MessageInfo___struct_seL4_MessageInfo_C)
od \<lbrace>\<lambda>ret'b s. globals_frame_intact s \<and> ipc_buffer_valid s \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs s v0 v1 v2 v3) \<and> tls_valid (setMRs s v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs s v0 v1 v2 v3))\<rbrace>!
 2. \<And>ret' ret'a. \<lbrace>?Q101 ret' ret'a\<rbrace> increment_64_internal' \<lbrace>?B102 ret' ret'a\<rbrace>!
 3. \<And>ret' ret'a. \<lbrace>?R101 ret' ret'a\<rbrace> return ret' \<lbrace>\<lambda>_ s64'. globals_frame_intact s64' \<and> tls_valid s64' \<and> 1 \<le> thread_index_C (tls s64') \<and> thread_index_C (tls s64') \<le> thread_count \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s64'\<rbrace>!
 4. \<And>ret'. \<lbrace>?B18 ret'\<rbrace> seL4_GetMR' 0 \<lbrace>\<lambda>ret'a s. if ret'a = 0 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> (\<forall>x r47' i_in_value. \<forall>i_symbol\<in>{''echo_int_i_1'', ''echo_int_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> ipc_buffer_valid (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 1 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> (\<forall>x r50' pin_in_value pout_out_value. \<forall>pin_symbol\<in>{''echo_parameter_pin_1'', ''echo_parameter_pin_2''}. \<forall>pout_symbol\<in>{''echo_parameter_pout_1'', ''echo_parameter_pout_2''}. \<forall>x. globals_frame_intact (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> ipc_buffer_valid (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 2 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> (\<forall>x r53' i_in_value. \<forall>i_symbol\<in>{''echo_char_i_1'', ''echo_char_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') \<and> ipc_buffer_valid (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 3 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> (\<forall>x x_in_value x_out_value. \<forall>x_symbol\<in>{''increment_char_x_1'', ''increment_char_x_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) \<and> ipc_buffer_valid (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 4 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> (\<forall>x x_in_value x_out_value. \<forall>x_symbol\<in>{''increment_parameter_x_1'', ''increment_parameter_x_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) \<and> ipc_buffer_valid (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 5 then ?Q101 ret' ret'a s else ?R101 ret' ret'a s\<rbrace>!
 5. \<lbrace>?Q17\<rbrace> condition (\<lambda>s. first65' \<noteq> 0)
  (seL4_Wait' 6 NULL)
  (return info66') \<lbrace>?B18\<rbrace>!
 6. \<And>s. globals_frame_intact s \<and> tls_valid s \<and> 1 \<le> thread_index_C (tls s) \<and> thread_index_C (tls s) \<le> thread_count \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s \<Longrightarrow> ?Q17 s proof (prove)
goal (5 subgoals):
 1. \<And>ret' ret'a. \<lbrace>?Q101 ret' ret'a\<rbrace> increment_64_internal' \<lbrace>\<lambda>x s. \<forall>x. globals_frame_intact s \<and> ipc_buffer_valid s \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs s v0 v1 v2 v3) \<and> tls_valid (setMRs s v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs s v0 v1 v2 v3))\<rbrace>!
 2. \<And>ret' ret'a. \<lbrace>?R101 ret' ret'a\<rbrace> return ret' \<lbrace>\<lambda>_ s64'. globals_frame_intact s64' \<and> tls_valid s64' \<and> 1 \<le> thread_index_C (tls s64') \<and> thread_index_C (tls s64') \<le> thread_count \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s64'\<rbrace>!
 3. \<And>ret'. \<lbrace>?B18 ret'\<rbrace> seL4_GetMR' 0 \<lbrace>\<lambda>ret'a s. if ret'a = 0 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> (\<forall>x r47' i_in_value. \<forall>i_symbol\<in>{''echo_int_i_1'', ''echo_int_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> ipc_buffer_valid (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 1 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> (\<forall>x r50' pin_in_value pout_out_value. \<forall>pin_symbol\<in>{''echo_parameter_pin_1'', ''echo_parameter_pin_2''}. \<forall>pout_symbol\<in>{''echo_parameter_pout_1'', ''echo_parameter_pout_2''}. \<forall>x. globals_frame_intact (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> ipc_buffer_valid (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 2 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> (\<forall>x r53' i_in_value. \<forall>i_symbol\<in>{''echo_char_i_1'', ''echo_char_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') \<and> ipc_buffer_valid (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 3 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> (\<forall>x x_in_value x_out_value. \<forall>x_symbol\<in>{''increment_char_x_1'', ''increment_char_x_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) \<and> ipc_buffer_valid (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 4 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> (\<forall>x x_in_value x_out_value. \<forall>x_symbol\<in>{''increment_parameter_x_1'', ''increment_parameter_x_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) \<and> ipc_buffer_valid (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 5 then ?Q101 ret' ret'a s else ?R101 ret' ret'a s\<rbrace>!
 4. \<lbrace>?Q17\<rbrace> condition (\<lambda>s. first65' \<noteq> 0)
  (seL4_Wait' 6 NULL)
  (return info66') \<lbrace>?B18\<rbrace>!
 5. \<And>s. globals_frame_intact s \<and> tls_valid s \<and> 1 \<le> thread_index_C (tls s) \<and> thread_index_C (tls s) \<le> thread_count \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s \<Longrightarrow> ?Q17 s proof (prove)
goal (4 subgoals):
 1. \<And>ret' ret'a. \<lbrace>?R101 ret' ret'a\<rbrace> return ret' \<lbrace>\<lambda>_ s64'. globals_frame_intact s64' \<and> tls_valid s64' \<and> 1 \<le> thread_index_C (tls s64') \<and> thread_index_C (tls s64') \<le> thread_count \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s64' (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s64' (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s64' (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s64'\<rbrace>!
 2. \<And>ret'. \<lbrace>?B18 ret'\<rbrace> seL4_GetMR' 0 \<lbrace>\<lambda>ret'a s. if ret'a = 0 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> (\<forall>x r47' i_in_value. \<forall>i_symbol\<in>{''echo_int_i_1'', ''echo_int_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> ipc_buffer_valid (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 1 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> (\<forall>x r50' pin_in_value pout_out_value. \<forall>pin_symbol\<in>{''echo_parameter_pin_1'', ''echo_parameter_pin_2''}. \<forall>pout_symbol\<in>{''echo_parameter_pout_1'', ''echo_parameter_pout_2''}. \<forall>x. globals_frame_intact (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> ipc_buffer_valid (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 2 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> (\<forall>x r53' i_in_value. \<forall>i_symbol\<in>{''echo_char_i_1'', ''echo_char_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') \<and> ipc_buffer_valid (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 3 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> (\<forall>x x_in_value x_out_value. \<forall>x_symbol\<in>{''increment_char_x_1'', ''increment_char_x_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) \<and> ipc_buffer_valid (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 4 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> (\<forall>x x_in_value x_out_value. \<forall>x_symbol\<in>{''increment_parameter_x_1'', ''increment_parameter_x_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) \<and> ipc_buffer_valid (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3))) else if sint (ucast_32_to_s32 ret'a) = 5 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> (\<forall>x x_in_value x_in_value_high x_out_value x_out_value_high. \<forall>x_symbol\<in>{''increment_64_x_1'', ''increment_64_x_2''}. \<forall>x. globals_frame_intact (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) \<and> ipc_buffer_valid (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3))) else ?R101 ret' ret'a s\<rbrace>!
 3. \<lbrace>?Q17\<rbrace> condition (\<lambda>s. first65' \<noteq> 0)
  (seL4_Wait' 6 NULL)
  (return info66') \<lbrace>?B18\<rbrace>!
 4. \<And>s. globals_frame_intact s \<and> tls_valid s \<and> 1 \<le> thread_index_C (tls s) \<and> thread_index_C (tls s) \<le> thread_count \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s \<Longrightarrow> ?Q17 s proof (prove)
goal (1 subgoal):
 1. \<And>s. globals_frame_intact s \<and> tls_valid s \<and> 1 \<le> thread_index_C (tls s) \<and> thread_index_C (tls s) \<le> thread_count \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s \<Longrightarrow> if first65' \<noteq> 0 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> (\<forall>x v0 v1 v2 v3 xa. 0 \<le> 0 \<and> 0 < 120 \<and> globals_frame_intact (setMRs s v0 v1 v2 v3) \<and> ipc_buffer_valid (setMRs s v0 v1 v2 v3) \<and> (if xa = 0 then globals_frame_intact (setMRs s v0 v1 v2 v3) \<and> ipc_buffer_valid (setMRs s v0 v1 v2 v3) \<and> tls_valid (setMRs s v0 v1 v2 v3) \<and> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<in> {1..thread_count} \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> (\<forall>x r47' i_in_value. \<forall>i_symbol\<in>{''echo_int_i_1'', ''echo_int_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w32 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r47') \<and> ipc_buffer_valid (setMR (update_global_w32 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r47') \<and> (\<forall>v0a v1a v2a v3a. globals_frame_intact (setMRs (setMR (update_global_w32 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r47') v0a v1a v2a v3a) \<and> tls_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r47') v0a v1a v2a v3a) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r47') v0a v1a v2a v3a)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r47') v0a v1a v2a v3a)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r47') v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r47') v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r47') v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r47') v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r47') v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r47') v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r47') v0a v1a v2a v3a) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r47') v0a v1a v2a v3a) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r47') v0a v1a v2a v3a) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r47') v0a v1a v2a v3a) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r47') v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r47') v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r47') v0a v1a v2a v3a) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r47') v0a v1a v2a v3a) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r47') v0a v1a v2a v3a))) else if sint (ucast_32_to_s32 xa) = 1 then globals_frame_intact (setMRs s v0 v1 v2 v3) \<and> ipc_buffer_valid (setMRs s v0 v1 v2 v3) \<and> tls_valid (setMRs s v0 v1 v2 v3) \<and> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<in> {1..thread_count} \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> (\<forall>x r50' pin_in_value pout_out_value. \<forall>pin_symbol\<in>{''echo_parameter_pin_1'', ''echo_parameter_pin_2''}. \<forall>pout_symbol\<in>{''echo_parameter_pout_1'', ''echo_parameter_pout_2''}. \<forall>x. globals_frame_intact (setMR (setMR (update_global_w32 pin_symbol pin_in_value (setMRs s v0 v1 v2 v3)) 0 r50') 1 pout_out_value) \<and> ipc_buffer_valid (setMR (setMR (update_global_w32 pin_symbol pin_in_value (setMRs s v0 v1 v2 v3)) 0 r50') 1 pout_out_value) \<and> (\<forall>v0a v1a v2a v3a. globals_frame_intact (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value (setMRs s v0 v1 v2 v3)) 0 r50') 1 pout_out_value) v0a v1a v2a v3a) \<and> tls_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value (setMRs s v0 v1 v2 v3)) 0 r50') 1 pout_out_value) v0a v1a v2a v3a) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value (setMRs s v0 v1 v2 v3)) 0 r50') 1 pout_out_value) v0a v1a v2a v3a)) \<and> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value (setMRs s v0 v1 v2 v3)) 0 r50') 1 pout_out_value) v0a v1a v2a v3a)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value (setMRs s v0 v1 v2 v3)) 0 r50') 1 pout_out_value) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value (setMRs s v0 v1 v2 v3)) 0 r50') 1 pout_out_value) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value (setMRs s v0 v1 v2 v3)) 0 r50') 1 pout_out_value) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value (setMRs s v0 v1 v2 v3)) 0 r50') 1 pout_out_value) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value (setMRs s v0 v1 v2 v3)) 0 r50') 1 pout_out_value) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value (setMRs s v0 v1 v2 v3)) 0 r50') 1 pout_out_value) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value (setMRs s v0 v1 v2 v3)) 0 r50') 1 pout_out_value) v0a v1a v2a v3a) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value (setMRs s v0 v1 v2 v3)) 0 r50') 1 pout_out_value) v0a v1a v2a v3a) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value (setMRs s v0 v1 v2 v3)) 0 r50') 1 pout_out_value) v0a v1a v2a v3a) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value (setMRs s v0 v1 v2 v3)) 0 r50') 1 pout_out_value) v0a v1a v2a v3a) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value (setMRs s v0 v1 v2 v3)) 0 r50') 1 pout_out_value) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value (setMRs s v0 v1 v2 v3)) 0 r50') 1 pout_out_value) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value (setMRs s v0 v1 v2 v3)) 0 r50') 1 pout_out_value) v0a v1a v2a v3a) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value (setMRs s v0 v1 v2 v3)) 0 r50') 1 pout_out_value) v0a v1a v2a v3a) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value (setMRs s v0 v1 v2 v3)) 0 r50') 1 pout_out_value) v0a v1a v2a v3a))) else if sint (ucast_32_to_s32 xa) = 2 then globals_frame_intact (setMRs s v0 v1 v2 v3) \<and> ipc_buffer_valid (setMRs s v0 v1 v2 v3) \<and> tls_valid (setMRs s v0 v1 v2 v3) \<and> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<in> {1..thread_count} \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> (\<forall>x r53' i_in_value. \<forall>i_symbol\<in>{''echo_char_i_1'', ''echo_char_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w8 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r53') \<and> ipc_buffer_valid (setMR (update_global_w8 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r53') \<and> (\<forall>v0a v1a v2a v3a. globals_frame_intact (setMRs (setMR (update_global_w8 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r53') v0a v1a v2a v3a) \<and> tls_valid (setMRs (setMR (update_global_w8 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r53') v0a v1a v2a v3a) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w8 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r53') v0a v1a v2a v3a)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w8 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r53') v0a v1a v2a v3a)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r53') v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r53') v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r53') v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r53') v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r53') v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r53') v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r53') v0a v1a v2a v3a) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r53') v0a v1a v2a v3a) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r53') v0a v1a v2a v3a) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r53') v0a v1a v2a v3a) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r53') v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r53') v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r53') v0a v1a v2a v3a) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r53') v0a v1a v2a v3a) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w8 i_symbol i_in_value (setMRs s v0 v1 v2 v3)) 0 r53') v0a v1a v2a v3a))) else if sint (ucast_32_to_s32 xa) = 3 then globals_frame_intact (setMRs s v0 v1 v2 v3) \<and> ipc_buffer_valid (setMRs s v0 v1 v2 v3) \<and> tls_valid (setMRs s v0 v1 v2 v3) \<and> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<in> {1..thread_count} \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> (\<forall>x x_in_value x_out_value. \<forall>x_symbol\<in>{''increment_char_x_1'', ''increment_char_x_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w8 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) \<and> ipc_buffer_valid (setMR (update_global_w8 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) \<and> (\<forall>v0a v1a v2a v3a. globals_frame_intact (setMRs (setMR (update_global_w8 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) \<and> tls_valid (setMRs (setMR (update_global_w8 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w8 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w8 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w8 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a))) else if sint (ucast_32_to_s32 xa) = 4 then globals_frame_intact (setMRs s v0 v1 v2 v3) \<and> ipc_buffer_valid (setMRs s v0 v1 v2 v3) \<and> tls_valid (setMRs s v0 v1 v2 v3) \<and> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<in> {1..thread_count} \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> (\<forall>x x_in_value x_out_value. \<forall>x_symbol\<in>{''increment_parameter_x_1'', ''increment_parameter_x_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w32 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) \<and> ipc_buffer_valid (setMR (update_global_w32 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) \<and> (\<forall>v0a v1a v2a v3a. globals_frame_intact (setMRs (setMR (update_global_w32 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) \<and> tls_valid (setMRs (setMR (update_global_w32 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w32 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w32 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w32 x_symbol x_in_value (setMRs s v0 v1 v2 v3)) 0 x_out_value) v0a v1a v2a v3a))) else if sint (ucast_32_to_s32 xa) = 5 then globals_frame_intact (setMRs s v0 v1 v2 v3) \<and> ipc_buffer_valid (setMRs s v0 v1 v2 v3) \<and> tls_valid (setMRs s v0 v1 v2 v3) \<and> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<in> {1..thread_count} \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> (\<forall>x x_in_value x_in_value_high x_out_value x_out_value_high. \<forall>x_symbol\<in>{''increment_64_x_1'', ''increment_64_x_2''}. \<forall>x. globals_frame_intact (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value (setMRs s v0 v1 v2 v3))) 0 x_out_value) 1 x_out_value_high) \<and> ipc_buffer_valid (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value (setMRs s v0 v1 v2 v3))) 0 x_out_value) 1 x_out_value_high) \<and> (\<forall>v0a v1a v2a v3a. globals_frame_intact (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value (setMRs s v0 v1 v2 v3))) 0 x_out_value) 1 x_out_value_high) v0a v1a v2a v3a) \<and> tls_valid (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value (setMRs s v0 v1 v2 v3))) 0 x_out_value) 1 x_out_value_high) v0a v1a v2a v3a) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value (setMRs s v0 v1 v2 v3))) 0 x_out_value) 1 x_out_value_high) v0a v1a v2a v3a)) \<and> thread_index_C (tls (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value (setMRs s v0 v1 v2 v3))) 0 x_out_value) 1 x_out_value_high) v0a v1a v2a v3a)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value (setMRs s v0 v1 v2 v3))) 0 x_out_value) 1 x_out_value_high) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value (setMRs s v0 v1 v2 v3))) 0 x_out_value) 1 x_out_value_high) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value (setMRs s v0 v1 v2 v3))) 0 x_out_value) 1 x_out_value_high) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value (setMRs s v0 v1 v2 v3))) 0 x_out_value) 1 x_out_value_high) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value (setMRs s v0 v1 v2 v3))) 0 x_out_value) 1 x_out_value_high) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value (setMRs s v0 v1 v2 v3))) 0 x_out_value) 1 x_out_value_high) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value (setMRs s v0 v1 v2 v3))) 0 x_out_value) 1 x_out_value_high) v0a v1a v2a v3a) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value (setMRs s v0 v1 v2 v3))) 0 x_out_value) 1 x_out_value_high) v0a v1a v2a v3a) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value (setMRs s v0 v1 v2 v3))) 0 x_out_value) 1 x_out_value_high) v0a v1a v2a v3a) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value (setMRs s v0 v1 v2 v3))) 0 x_out_value) 1 x_out_value_high) v0a v1a v2a v3a) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value (setMRs s v0 v1 v2 v3))) 0 x_out_value) 1 x_out_value_high) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value (setMRs s v0 v1 v2 v3))) 0 x_out_value) 1 x_out_value_high) v0a v1a v2a v3a) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value (setMRs s v0 v1 v2 v3))) 0 x_out_value) 1 x_out_value_high) v0a v1a v2a v3a) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value (setMRs s v0 v1 v2 v3))) 0 x_out_value) 1 x_out_value_high) v0a v1a v2a v3a) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value (setMRs s v0 v1 v2 v3))) 0 x_out_value) 1 x_out_value_high) v0a v1a v2a v3a))) else globals_frame_intact (setMRs s v0 v1 v2 v3) \<and> tls_valid (setMRs s v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs s v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs s v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs s v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs s v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs s v0 v1 v2 v3))) else \<forall>x. 0 \<le> 0 \<and> 0 < 120 \<and> globals_frame_intact s \<and> ipc_buffer_valid s \<and> (if x = 0 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> (\<forall>x r47' i_in_value. \<forall>i_symbol\<in>{''echo_int_i_1'', ''echo_int_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> ipc_buffer_valid (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w32 i_symbol i_in_value s) 0 r47') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 x) = 1 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> (\<forall>x r50' pin_in_value pout_out_value. \<forall>pin_symbol\<in>{''echo_parameter_pin_1'', ''echo_parameter_pin_2''}. \<forall>pout_symbol\<in>{''echo_parameter_pout_1'', ''echo_parameter_pout_2''}. \<forall>x. globals_frame_intact (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> ipc_buffer_valid (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (setMR (update_global_w32 pin_symbol pin_in_value s) 0 r50') 1 pout_out_value) v0 v1 v2 v3))) else if sint (ucast_32_to_s32 x) = 2 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> (\<forall>x r53' i_in_value. \<forall>i_symbol\<in>{''echo_char_i_1'', ''echo_char_i_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') \<and> ipc_buffer_valid (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w8 i_symbol i_in_value s) 0 r53') v0 v1 v2 v3))) else if sint (ucast_32_to_s32 x) = 3 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> (\<forall>x x_in_value x_out_value. \<forall>x_symbol\<in>{''increment_char_x_1'', ''increment_char_x_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) \<and> ipc_buffer_valid (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w8 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3))) else if sint (ucast_32_to_s32 x) = 4 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> (\<forall>x x_in_value x_out_value. \<forall>x_symbol\<in>{''increment_parameter_x_1'', ''increment_parameter_x_2''}. \<forall>x. globals_frame_intact (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) \<and> ipc_buffer_valid (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (update_global_w32 x_symbol x_in_value s) 0 x_out_value) v0 v1 v2 v3))) else if sint (ucast_32_to_s32 x) = 5 then globals_frame_intact s \<and> ipc_buffer_valid s \<and> tls_valid s \<and> thread_index_C (tls s) \<in> {1..thread_count} \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> (\<forall>x x_in_value x_in_value_high x_out_value x_out_value_high. \<forall>x_symbol\<in>{''increment_64_x_1'', ''increment_64_x_2''}. \<forall>x. globals_frame_intact (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) \<and> ipc_buffer_valid (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) \<and> (\<forall>v0 v1 v2 v3. globals_frame_intact (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) \<and> tls_valid (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) \<and> 1 \<le> thread_index_C (tls (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3)) \<and> thread_index_C (tls (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3)) \<le> thread_count \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3) (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid (setMRs (setMR (setMR (update_global_w64_high x_symbol x_in_value_high (update_global_w64 x_symbol x_in_value s)) 0 x_out_value) 1 x_out_value_high) v0 v1 v2 v3))) else globals_frame_intact s \<and> tls_valid s \<and> 1 \<le> thread_index_C (tls s) \<and> thread_index_C (tls s) \<le> thread_count \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_int_i_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pin_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''echo_parameter_pout_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''echo_char_i_2'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_1'')) \<and> is_valid_w8 s (PTR(8 word) (symbol_table ''increment_char_x_2'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_1'')) \<and> is_valid_w32 s (PTR(32 word) (symbol_table ''increment_parameter_x_2'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_1'')) \<and> is_valid_w64 s (PTR(64 word) (symbol_table ''increment_64_x_2'')) \<and> ipc_buffer_valid s) proof (prove)
goal:
No subgoals!