theory Ipc_C

lemma copyMRsFault_ccorres_syscall:
  "ccorres dc xfdc
           (valid_pspace'
             and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) ARM_H.syscallMessage = msg) sender
             and (case recvBuffer of Some x \<Rightarrow> valid_ipc_buffer_ptr' x | None \<Rightarrow> \<top>)
             and K (length msg = 12)
             and K (recvBuffer \<noteq> Some 0)
             and K (sender \<noteq> receiver))
           (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace>
                 \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>
                 \<inter> \<lbrace>\<acute>receiveIPCBuffer = Ptr (option_to_0 recvBuffer)\<rbrace>
                 \<inter> \<lbrace>\<acute>length___unsigned_long = 12 \<rbrace>
                 \<inter> \<lbrace> \<acute>id___anonymous_enum = MessageID_Syscall \<rbrace>)
           hs
           (mapM_x (\<lambda>(x, y). setMR receiver recvBuffer x y) (zip [0..<120] msg))
           (Call copyMRsFault_'proc)" proof - 
  (* auxiliary lemmas *)
   have option_to_0_imp : "\<lbrakk> option_to_0 recvBuffer= 0 ; recvBuffer \<noteq> Some 0 \<rbrakk> \<Longrightarrow> recvBuffer = None" by (simp add: option_to_0_def; cases recvBuffer; simp+) have drop_n: "\<And>n m. drop n [0..<m] = [n..<m]" by simp have less_than_4: "\<And>x y n m. elem (x, y) (zip [n..<120] m) \<Longrightarrow> \<not> x < n " by (simp | erule in_set_zipE)+ have msg_aux: "\<forall>p. elem p (zip [4..<120] (drop 4 msg))
                    \<longrightarrow> (\<lambda>(x1,y1). setMR receiver None x1 y1) p = (\<lambda>_ . return (length msgRegisters)) p" by (fastforce simp add: numeral_eqs setMR_def less_than_4 n_msgRegisters_def length_msgRegisters
                            take_bit_Suc
                  simp del: unsigned_numeral) have mapM_x_return_gen: "\<And>v w xs. mapM_x (\<lambda>_. return v) xs = return w"  (* FIXME mapM_x_return *)
     by (induct_tac xs; simp add: mapM_x_Nil mapM_x_Cons) show ?thesis including no_pre apply (unfold K_def) apply (intro ccorres_gen_asm) apply (cinit' lift: sender_' receiver_' receiveIPCBuffer_'
                     length___unsigned_long_' id___anonymous_enum_'
                simp: whileAnno_def) apply (simp only: mapM_x_append[where xs="take (unat n_msgRegisters) (zip as bs)"
                                         and ys="drop (unat n_msgRegisters) (zip as bs)"
                                         for as bs, simplified] bind_assoc) apply (rule ccorres_rhs_assoc2, rule ccorres_split_nothrow_novcg) apply (rule_tac F="K $ obj_at' (\<lambda>tcb. map ((atcbContext o tcbArch) tcb) ARM_H.syscallMessage = msg) sender"
                     in ccorres_mapM_x_while) apply (clarsimp simp: n_msgRegisters_def) apply (rule ccorres_guard_imp2) apply (rule_tac t=sender and r="ARM_H.syscallMessage ! n"
                            in ccorres_add_getRegister) apply (ctac(no_vcg)) apply (rule_tac P="\<lambda>s. rv = msg ! n" in ccorres_cross_over_guard) apply (simp add: setMR_def length_msgRegisters n_msgRegisters_def
                                    liftM_def[symmetric]) apply ctac apply (wp user_getreg_rv) apply (clarsimp simp: msgRegisters_ccorres n_msgRegisters_def
                                 syscallMessage_ccorres n_syscallMessage_def
                                 obj_at'_def projectKOs
                                 atcbContextGet_def unat_of_nat32[unfolded word_bits_def]) apply (clarsimp simp: word_of_nat_less MessageID_Syscall_def) apply (simp add: n_msgRegisters_def) apply (rule allI, rule conseqPre, vcg exspec=setRegister_modifies exspec=getRegister_modifies) apply simp apply (simp add: setMR_def) apply (rule hoare_pre) apply (wp asUser_obj_at_elsewhere | wpc)+ apply simp apply (simp add: word_bits_def) apply ceqv apply (rule ccorres_Cond_rhs) apply (simp del: Collect_const) apply (rule ccorres_rel_imp) apply (rule_tac F="\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContext o tcbArch) tcb) ARM_H.syscallMessage = msg)
                                        sender and valid_pspace'
                                        and (case recvBuffer of Some x \<Rightarrow> valid_ipc_buffer_ptr' x | None \<Rightarrow> \<top>)"
                            in ccorres_mapM_x_while'[where i="unat n_msgRegisters"]) apply (clarsimp simp: setMR_def n_msgRegisters_def length_msgRegisters
                                           option_to_0_def liftM_def[symmetric]
                                    split: option.split_asm) apply (rule ccorres_guard_imp2) apply (rule_tac t=sender and r="ARM_H.syscallMessage ! (n + unat n_msgRegisters)"
                                     in ccorres_add_getRegister) apply (ctac(no_vcg)) apply (rule_tac P="\<lambda>s. rv = msg ! (n + unat n_msgRegisters)"
                             in ccorres_cross_over_guard) apply (rule ccorres_move_array_assertion_ipc_buffer
                   | (rule ccorres_flip_Guard, rule ccorres_move_array_assertion_ipc_buffer))+ apply (simp add: storeWordUser_def) apply (rule ccorres_pre_stateAssert) apply (ctac add: storeWord_ccorres[unfolded fun_app_def]) apply (simp add: pred_conj_def) apply (wp user_getreg_rv) apply (clarsimp simp: n_syscallMessage_def n_msgRegisters_def
                                 syscallMessage_ccorres msgRegisters_ccorres
                                 unat_add_lem[THEN iffD1] unat_of_nat32
                                 word_bits_def word_size_def) apply (simp only:field_simps imp_ex imp_conjL) apply (clarsimp simp: pointerInUserData_c_guard obj_at'_def
                                 pointerInUserData_h_t_valid
                                 atcbContextGet_def
                                 projectKOs objBits_simps word_less_nat_alt
                                 unat_add_lem[THEN iffD1] unat_of_nat) apply (clarsimp simp: pointerInUserData_h_t_valid rf_sr_def
                                 MessageID_Syscall_def
                                 msg_align_bits valid_ipc_buffer_ptr'_def) apply (erule aligned_add_aligned) apply (rule aligned_add_aligned[where n=2]) apply (simp add: is_aligned_def) apply (rule is_aligned_mult_triv2 [where n=2, simplified]) apply (simp)+ apply (simp add: n_msgRegisters_def) apply (vcg exspec=getRegister_modifies) apply simp apply (simp add: setMR_def n_msgRegisters_def length_msgRegisters) apply (rule hoare_pre) apply (wp hoare_case_option_wp | wpc)+ apply clarsimp apply (simp add: n_msgRegisters_def word_bits_def) apply (simp add: n_msgRegisters_def) apply simp apply (frule (1) option_to_0_imp) apply (subst drop_zip) apply (subst drop_n) apply (clarsimp simp:  n_msgRegisters_def numeral_eqs
                            mapM_cong[OF msg_aux, simplified numeral_eqs]) apply (subst mapM_x_return_gen[where w2="()"]) apply (rule ccorres_return_Skip) apply (clarsimp) apply (rule hoare_impI) apply (rule mapM_x_wp_inv) apply (cases recvBuffer; simp add: option_to_0_def split_def) apply (erule hoare_vcg_conj_lift
                   [OF setMR_atcbContext_obj_at[simplified atcbContextGet_def, simplified]]) apply wp apply (clarsimp simp: guard_is_UNIV_def n_msgRegisters_def msgLengthBits_def
                         mask_def)+ done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length msg = 12) and K (recvBuffer \<noteq> Some 0) and K (sender \<noteq> receiver)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer)\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>) hs (mapM_x (\<lambda>(x, y). setMR receiver recvBuffer x y) (zip [0..<120] msg)) (Call copyMRsFault_'proc) proof (state)
goal (1 subgoal):
 1. ccorres dc xfdc (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length msg = 12) and K (recvBuffer \<noteq> Some 0) and K (sender \<noteq> receiver)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer)\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>) hs (mapM_x (\<lambda>(x, y). setMR receiver recvBuffer x y) (zip [0..<120] msg)) (Call copyMRsFault_'proc) proof (state)
goal (1 subgoal):
 1. ccorres dc xfdc (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length msg = 12) and K (recvBuffer \<noteq> Some 0) and K (sender \<noteq> receiver)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer)\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>) hs (mapM_x (\<lambda>(x, y). setMR receiver recvBuffer x y) (zip [0..<120] msg)) (Call copyMRsFault_'proc) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>option_to_0 recvBuffer = 0; recvBuffer \<noteq> Some 0\<rbrakk> \<Longrightarrow> recvBuffer = None proof (state)
this:
\<lbrakk>option_to_0 recvBuffer = 0; recvBuffer \<noteq> Some 0\<rbrakk> \<Longrightarrow> recvBuffer = None

goal (1 subgoal):
 1. ccorres dc xfdc (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length msg = 12) and K (recvBuffer \<noteq> Some 0) and K (sender \<noteq> receiver)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer)\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>) hs (mapM_x (\<lambda>(x, y). setMR receiver recvBuffer x y) (zip [0..<120] msg)) (Call copyMRsFault_'proc) proof (prove)
goal (1 subgoal):
 1. \<And>n m. drop n [0..<m] = [n..<m] proof (state)
this:
drop ?n1 [0..<?m1] = [?n1..<?m1]

goal (1 subgoal):
 1. ccorres dc xfdc (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length msg = 12) and K (recvBuffer \<noteq> Some 0) and K (sender \<noteq> receiver)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer)\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>) hs (mapM_x (\<lambda>(x, y). setMR receiver recvBuffer x y) (zip [0..<120] msg)) (Call copyMRsFault_'proc) proof (prove)
goal (1 subgoal):
 1. \<And>x y n m. elem (x, y) (zip [n..<120] m) \<Longrightarrow> \<not> x < n proof (state)
this:
elem (?x1, ?y1) (zip [?n1..<120] ?m1) \<Longrightarrow> \<not> ?x1 < ?n1

goal (1 subgoal):
 1. ccorres dc xfdc (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length msg = 12) and K (recvBuffer \<noteq> Some 0) and K (sender \<noteq> receiver)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer)\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>) hs (mapM_x (\<lambda>(x, y). setMR receiver recvBuffer x y) (zip [0..<120] msg)) (Call copyMRsFault_'proc) proof (prove)
goal (1 subgoal):
 1. \<forall>p. elem p (zip [4..<120] (drop 4 msg)) \<longrightarrow> (case p of (x1, y1) \<Rightarrow> setMR receiver None x1 y1) = return (length TCB_H.msgRegisters) proof (state)
this:
\<forall>p. elem p (zip [4..<120] (drop 4 msg)) \<longrightarrow> (case p of (x1, y1) \<Rightarrow> setMR receiver None x1 y1) = return (length TCB_H.msgRegisters)

goal (1 subgoal):
 1. ccorres dc xfdc (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length msg = 12) and K (recvBuffer \<noteq> Some 0) and K (sender \<noteq> receiver)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer)\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>) hs (mapM_x (\<lambda>(x, y). setMR receiver recvBuffer x y) (zip [0..<120] msg)) (Call copyMRsFault_'proc) proof (prove)
goal (1 subgoal):
 1. \<And>v w xs. mapM_x (\<lambda>_. return v) xs = return w proof (prove)
goal (1 subgoal):
 1. \<And>v w xs. mapM_x (\<lambda>_. return v) xs = return w proof (state)
this:
mapM_x (\<lambda>_. return ?v2) ?xs2 = return ?w2

goal (1 subgoal):
 1. ccorres dc xfdc (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length msg = 12) and K (recvBuffer \<noteq> Some 0) and K (sender \<noteq> receiver)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer)\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>) hs (mapM_x (\<lambda>(x, y). setMR receiver recvBuffer x y) (zip [0..<120] msg)) (Call copyMRsFault_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length msg = 12) and K (recvBuffer \<noteq> Some 0) and K (sender \<noteq> receiver)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer)\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>) hs (mapM_x (\<lambda>(x, y). setMR receiver recvBuffer x y) (zip [0..<120] msg)) (Call copyMRsFault_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length msg = 12) and K (recvBuffer \<noteq> Some 0) and K (sender \<noteq> receiver)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer)\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>) hs (mapM_x (\<lambda>(x, y). setMR receiver recvBuffer x y) (zip [0..<120] msg)) (Call copyMRsFault_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (\<lambda>y. length msg = 12) and (\<lambda>y. recvBuffer \<noteq> Some 0) and (\<lambda>y. sender \<noteq> receiver)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer)\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>) hs (mapM_x (\<lambda>(x, y). setMR receiver recvBuffer x y) (zip [0..<120] msg)) (Call copyMRsFault_'proc) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12\<rbrakk> \<Longrightarrow> ccorres dc xfdc (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer)\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>) hs (mapM_x (\<lambda>(x, y). setMR receiver recvBuffer x y) (zip [0..<120] msg)) (Call copyMRsFault_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1379 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) (?Q'1379 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) (SKIP # hs) (mapM_x (\<lambda>(x, y). setMR receiver recvBuffer x y) (zip [0..<120] msg)) (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < (if length___unsigned_long < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then length___unsigned_long else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>id___anonymous_enum <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s id___anonymous_enum\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(sendera,kernel_all_global_addresses.fault_messages.[unat id___anonymous_enum].[unat \<acute>i]))));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(receivera,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
IF receiveIPCBuffer \<noteq> NULL THEN
  While \<lbrace>\<acute>i < length___unsigned_long\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>id___anonymous_enum <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s id___anonymous_enum\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(sendera,kernel_all_global_addresses.fault_messages.[unat id___anonymous_enum].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion receiveIPCBuffer (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (receiveIPCBuffer +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion receiveIPCBuffer (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (receiveIPCBuffer +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI))
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1379 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s \<and> s' \<in> ?Q'1379 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera proof (prove)
goal (2 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1379 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)) (?Q'1379 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)) (SKIP # hs) (do y <- mapM_x (\<lambda>(x, y). setMR receiver recvBuffer x y) (take (unat n_msgRegisters) (zip [0..<120] msg));
mapM_x (\<lambda>(x, y). setMR receiver recvBuffer x y) (drop (unat n_msgRegisters) (zip [0..<120] msg))
od) (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < (if 0xC < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then 0xC else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
IF PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL THEN
  While \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI))
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1379 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s \<and> s' \<in> ?Q'1379 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera proof (prove)
goal (6 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ccorres (?r'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) (?xf'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) (?P1395 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)) (?Q'1379 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)) [] (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg))) (\<acute>i :== 0;;
While \<lbrace>\<acute>i < (if 0xC < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then 0xC else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1))
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' t t'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) rv' t t' (IF PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL THEN
  While \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; ?r'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera\<rbrace>
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) (?xf'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera)
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P1395 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> ?Q'1379 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera proof (prove)
goal (10 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<forall>n<length (take (unat n_msgRegisters) (zip [0..<120] msg)). ccorres dc xfdc ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) n) \<lbrace>\<acute>i = word_of_nat n\<rbrace> [] (case take (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)))
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> (n < (if 0xC < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then 0xC else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))))
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; Suc n < length (take (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>(K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) n\<rbrace> case take (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. (K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) (Suc n)\<rbrace>
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> length (take (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' t t'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL THEN
  While \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera\<rbrace>
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera)
 10. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (10 subgoals):
 1. \<And>n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; n < 4\<rbrakk> \<Longrightarrow> ccorres dc xfdc (obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender) \<lbrace>\<acute>i = word_of_nat n\<rbrace> [] (setMR receiver recvBuffer n (msg ! n)) (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds (if MessageID_Syscall <s 2 then UNIV else {}) (Guard ArrayBounds (if 0 \<le>s MessageID_Syscall then UNIV else {}) (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)))
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> (n < (if 0xC < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then 0xC else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))))
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; Suc n < length (take (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>(K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) n\<rbrace> case take (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. (K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) (Suc n)\<rbrace>
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> length (take (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' t t'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL THEN
  While \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera\<rbrace>
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera)
 10. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (11 subgoals):
 1. \<And>n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; n < 4\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1413 n) (?Q'1413 n) [] (setMR receiver recvBuffer n (msg ! n)) (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds (if MessageID_Syscall <s 2 then UNIV else {}) (Guard ArrayBounds (if 0 \<le>s MessageID_Syscall then UNIV else {}) (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)))
 2. \<And>n s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; n < 4; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender s; s' \<in> \<lbrace>\<acute>i = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ?Q1413 n s \<and> s' \<in> ?Q'1413 n
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> (n < (if 0xC < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then 0xC else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))))
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; Suc n < length (take (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>(K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) n\<rbrace> case take (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. (K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) (Suc n)\<rbrace>
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> length (take (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' t t'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL THEN
  While \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera\<rbrace>
 10. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; n < 4\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1416 n) (?Q'1413 n) [] (do _ <- asUser sender (getRegister (FaultHandler_H.syscallMessage ! n));
setMR receiver recvBuffer n (msg ! n)
od) (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds (if MessageID_Syscall <s 2 then UNIV else {}) (Guard ArrayBounds (if 0 \<le>s MessageID_Syscall then UNIV else {}) (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)))
 2. \<And>n s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; n < 4; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender s; s' \<in> \<lbrace>\<acute>i = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (?P1416 n and tcb_at' sender) s \<and> s' \<in> ?Q'1413 n
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> (n < (if 0xC < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then 0xC else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))))
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; Suc n < length (take (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>(K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) n\<rbrace> case take (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. (K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) (Suc n)\<rbrace>
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> length (take (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' t t'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL THEN
  While \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera\<rbrace>
 10. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera)
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>n rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; n < 4; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1422 n rv) (?Q'1422 n rv ret__unsigned_long) [] (setMR receiver recvBuffer n (msg ! n)) (Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],ret__unsigned_long)))
 2. \<And>n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; n < 4\<rbrakk> \<Longrightarrow> \<lbrace>?R1422 n\<rbrace> asUser sender (getRegister (FaultHandler_H.syscallMessage ! n)) \<lbrace>?Q1422 n\<rbrace>
 3. \<And>n s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; n < 4; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender s; s' \<in> \<lbrace>\<acute>i = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1422 n and tcb_at' sender) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (FaultHandler_H.syscallMessage ! n)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q'1422 n rv (ret__unsigned_long_' t)} \<inter> (if 0 \<le>s MessageID_Syscall then UNIV else {}) \<inter> (if MessageID_Syscall <s 2 then UNIV else {}) \<inter> \<lbrace>\<acute>i < 0xC\<rbrace>
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> (n < (if 0xC < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then 0xC else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))))
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; Suc n < length (take (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>(K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) n\<rbrace> case take (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. (K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) (Suc n)\<rbrace>
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> length (take (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' t t'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL THEN
  While \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 10. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>n rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; n < 4; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'1469 n rv) (?Q1465 n rv ret__unsigned_long) [] (setMR receiver recvBuffer n (msg ! n)) (Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],ret__unsigned_long)))
 2. \<And>n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; n < 4\<rbrakk> \<Longrightarrow> \<lbrace>?R1422 n\<rbrace> asUser sender (getRegister (FaultHandler_H.syscallMessage ! n)) \<lbrace>\<lambda>rv. (\<lambda>s. rv = msg ! n) and ?P'1469 n rv\<rbrace>
 3. \<And>n s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; n < 4; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender s; s' \<in> \<lbrace>\<acute>i = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1422 n and tcb_at' sender) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (FaultHandler_H.syscallMessage ! n)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> rv = msg ! n \<longrightarrow> s' \<in> ?Q1465 n rv (ret__unsigned_long_' t)}} \<inter> (if 0 \<le>s MessageID_Syscall then UNIV else {}) \<inter> (if MessageID_Syscall <s 2 then UNIV else {}) \<inter> \<lbrace>\<acute>i < 0xC\<rbrace>
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> (n < (if 0xC < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then 0xC else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))))
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; Suc n < length (take (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>(K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) n\<rbrace> case take (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. (K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) (Suc n)\<rbrace>
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> length (take (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' t t'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL THEN
  While \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 10. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>n rv ret__unsigned_long. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; n < 4; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'1469 n ret__unsigned_long) (?Q1465 n ret__unsigned_long ret__unsigned_long) [] (asUser receiver (setRegister (TCB_H.msgRegisters ! n) (msg ! n))) (Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],ret__unsigned_long)))
 2. \<And>n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; n < 4\<rbrakk> \<Longrightarrow> \<lbrace>?R1422 n\<rbrace> asUser sender (getRegister (FaultHandler_H.syscallMessage ! n)) \<lbrace>\<lambda>rv. (\<lambda>s. rv = msg ! n) and ?P'1469 n rv\<rbrace>
 3. \<And>n s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; n < 4; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender s; s' \<in> \<lbrace>\<acute>i = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1422 n and tcb_at' sender) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (FaultHandler_H.syscallMessage ! n)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> rv = msg ! n \<longrightarrow> s' \<in> ?Q1465 n rv (ret__unsigned_long_' t)}} \<inter> (if 0 \<le>s MessageID_Syscall then UNIV else {}) \<inter> (if MessageID_Syscall <s 2 then UNIV else {}) \<inter> \<lbrace>\<acute>i < 0xC\<rbrace>
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> (n < (if 0xC < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then 0xC else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))))
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; Suc n < length (take (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>(K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) n\<rbrace> case take (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. (K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) (Suc n)\<rbrace>
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> length (take (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' t t'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL THEN
  While \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 10. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; n < 4\<rbrakk> \<Longrightarrow> \<lbrace>?R1422 n\<rbrace> asUser sender (getRegister (FaultHandler_H.syscallMessage ! n)) \<lbrace>\<lambda>rv. (\<lambda>s. rv = msg ! n) and (\<lambda>a. True)\<rbrace>
 2. \<And>n s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; n < 4; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender s; s' \<in> \<lbrace>\<acute>i = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1422 n and tcb_at' sender) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (FaultHandler_H.syscallMessage ! n)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> rv = msg ! n \<longrightarrow> s' \<in> {s. w_'_update (\<lambda>_. ret__unsigned_long_' t) (reg_'_update (\<lambda>_. kernel_all_global_addresses.msgRegisters.[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (TCB_H.msgRegisters ! n)\<rbrace> \<inter> \<lbrace>\<acute>w = msg ! n\<rbrace>} \<inter> \<lbrace>\<acute>i < 4\<rbrace>}} \<inter> (if 0 \<le>s MessageID_Syscall then UNIV else {}) \<inter> (if MessageID_Syscall <s 2 then UNIV else {}) \<inter> \<lbrace>\<acute>i < 0xC\<rbrace>
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> (n < (if 0xC < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then 0xC else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))))
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; Suc n < length (take (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>(K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) n\<rbrace> case take (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. (K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) (Suc n)\<rbrace>
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> length (take (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' t t'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL THEN
  While \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera\<rbrace>
 10. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>n s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; n < 4; (s, s') \<in> rf_sr; obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender s; s' \<in> \<lbrace>\<acute>i = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and obj_at' (\<lambda>tcb. (atcbContextGet \<circ> tcbArch) tcb (FaultHandler_H.syscallMessage ! n) = msg ! n \<and> True) sender and tcb_at' sender) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (FaultHandler_H.syscallMessage ! n)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> rv = msg ! n \<longrightarrow> s' \<in> {s. w_'_update (\<lambda>_. ret__unsigned_long_' t) (reg_'_update (\<lambda>_. kernel_all_global_addresses.msgRegisters.[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr receiver) s)) \<in> UNIV \<inter> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (TCB_H.msgRegisters ! n)\<rbrace> \<inter> \<lbrace>\<acute>w = msg ! n\<rbrace>} \<inter> \<lbrace>\<acute>i < 4\<rbrace>}} \<inter> (if 0 \<le>s MessageID_Syscall then UNIV else {}) \<inter> (if MessageID_Syscall <s 2 then UNIV else {}) \<inter> \<lbrace>\<acute>i < 0xC\<rbrace>
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> (n < (if 0xC < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then 0xC else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))))
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; Suc n < length (take (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>(K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) n\<rbrace> case take (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. (K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) (Suc n)\<rbrace>
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> length (take (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' t t'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL THEN
  While \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera\<rbrace>
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera)
 10. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (10 subgoals):
 1. \<And>n s s' obj. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length FaultHandler_H.syscallMessage = 12; n < 4; (s, s') \<in> rf_sr; i_' s' = word_of_nat n; ksPSpace s sender = Some (KOTCB obj); is_aligned sender (objBitsKO (KOTCB obj)); ps_clear sender (objBitsKO (KOTCB obj)) s; msg = map (atcbContext (tcbArch obj)) FaultHandler_H.syscallMessage\<rbrakk> \<Longrightarrow> ((\<exists>t. (\<exists>s. (s, s'\<lparr>globals := globals t\<rparr>) \<in> rf_sr) \<and> ret__unsigned_long_' t = atcbContext (tcbArch obj) (FaultHandler_H.syscallMessage ! n)) \<longrightarrow> word_of_nat n < 4) \<and> s' \<in> (if 0 \<le>s MessageID_Syscall then UNIV else {}) \<and> s' \<in> (if MessageID_Syscall <s 2 then UNIV else {}) \<and> word_of_nat n < 0xC
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> (n < (if 0xC < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then 0xC else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))))
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; Suc n < length (take (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>(K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) n\<rbrace> case take (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. (K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) (Suc n)\<rbrace>
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> length (take (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' t t'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL THEN
  While \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera\<rbrace>
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera)
 10. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (9 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> (n < (if 0xC < SCAST(32 signed \<rightarrow> 32) n_msgRegisters then 0xC else SCAST(32 signed \<rightarrow> 32) n_msgRegisters)) = (n < word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))))
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; Suc n < length (take (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>(K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) n\<rbrace> case take (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. (K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) (Suc n)\<rbrace>
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> length (take (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' t t'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL THEN
  While \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera\<rbrace>
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera)
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (8 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; Suc n < length (take (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>(K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) n\<rbrace> case take (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. (K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) (Suc n)\<rbrace>
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> length (take (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' t t'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL THEN
  While \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera\<rbrace>
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera)
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (8 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> {s} \<subseteq> \<lbrace>\<acute>i < 0xC \<longrightarrow> MessageID_Syscall <s 2 \<longrightarrow> 0 \<le>s MessageID_Syscall \<longrightarrow> \<acute>i < 4 \<longrightarrow> \<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; Suc n < length (take (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>(K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) n\<rbrace> case take (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. (K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) (Suc n)\<rbrace>
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> length (take (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' t t'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL THEN
  While \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera\<rbrace>
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera)
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (7 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; Suc n < length (take (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>(K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) n\<rbrace> case take (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. (K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) (Suc n)\<rbrace>
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> length (take (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' t t'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL THEN
  While \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera\<rbrace>
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera)
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (7 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; n < 11 \<and> Suc n < unat n_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender\<rbrace> if n < length TCB_H.msgRegisters then do asUser receiver (setRegister (TCB_H.msgRegisters ! n) (msg ! n));
return (n + 1)
od else case recvBuffer of None \<Rightarrow> return (length TCB_H.msgRegisters) | Some buf \<Rightarrow> do storeWordUser (buf + word_of_nat (n + 1) * word_size) (msg ! n);
return (n + 1)
od \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender\<rbrace>
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> length (take (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' t t'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL THEN
  While \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera\<rbrace>
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera)
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (8 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; n < 11 \<and> Suc n < unat n_msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?Q1584 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera n\<rbrace> if n < length TCB_H.msgRegisters then do asUser receiver (setRegister (TCB_H.msgRegisters ! n) (msg ! n));
return (n + 1)
od else case recvBuffer of None \<Rightarrow> return (length TCB_H.msgRegisters) | Some buf \<Rightarrow> do storeWordUser (buf + word_of_nat (n + 1) * word_size) (msg ! n);
return (n + 1)
od \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender\<rbrace>
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera n s. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; n < 11 \<and> Suc n < unat n_msgRegisters; obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender s\<rbrakk> \<Longrightarrow> ?Q1584 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera n s
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> length (take (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' t t'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL THEN
  While \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera\<rbrace>
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera)
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (7 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera n s. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; n < 11 \<and> Suc n < unat n_msgRegisters; obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender s\<rbrakk> \<Longrightarrow> (n < length TCB_H.msgRegisters \<longrightarrow> (obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (\<lambda>_. receiver \<noteq> sender)) s) \<and> (\<not> n < length TCB_H.msgRegisters \<longrightarrow> (recvBuffer = None \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender s) \<and> (\<forall>x. recvBuffer = Some x \<longrightarrow> obj_at' (\<lambda>a. map (atcbContext (tcbArch a)) FaultHandler_H.syscallMessage = msg) sender s))
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> length (take (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' t t'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL THEN
  While \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera\<rbrace>
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera)
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (6 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> length (take (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' t t'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL THEN
  While \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera\<rbrace>
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera)
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (5 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' t t'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL THEN
  While \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) (?d'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv')
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera\<rbrace>
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera)
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) (IF PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL THEN
  While \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1)
FI)
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>?Q1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera\<rbrace>
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (?Q'1389 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera)
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (5 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1742 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?S1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) (While \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1))
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?Q1742 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?S1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (5 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1742 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) ()) (?S1740 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () (word_of_nat (min 12 (unat n_msgRegisters)))) (SKIP # hs) (mapM_x (\<lambda>(x, y). setMR receiver recvBuffer x y) (drop (unat n_msgRegisters) (zip [0..<120] msg))) (While \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (option_to_0 recvBuffer + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer + (\<acute>i * 4 + 4))) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1))
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?Q1742 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?S1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (6 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (?r'1749 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv') (?xf'1749 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv') (?Q1742 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) ()) (?S1740 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () (word_of_nat (min 12 (unat n_msgRegisters)))) (SKIP # hs) (mapM_x (\<lambda>(x, y). setMR receiver recvBuffer x y) (drop (unat n_msgRegisters) (zip [0..<120] msg))) (While \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (option_to_0 recvBuffer + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer + (\<acute>i * 4 + 4))) \<acute>ret__unsigned_long)))));;
\<acute>i :== \<acute>i + 1))
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' x y. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; ?r'1749 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' x (?xf'1749 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' y)\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?Q1742 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?S1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (10 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>n<length (drop (unat n_msgRegisters) (zip [0..<120] msg)). ccorres dc xfdc (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters) + word_of_nat n\<rbrace> (SKIP # hs) (case drop (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (option_to_0 recvBuffer + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer + (\<acute>i * 4 + 4))) \<acute>ret__unsigned_long))))))
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 0xC) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg))))
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (option_to_0 recvBuffer + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer + (\<acute>i * 4 + 4))) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; Suc n < length (drop (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace> case drop (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace>
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (drop (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' x y. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
 10. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (10 subgoals):
 1. \<And>x2 n. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length msg = 12; recvBuffer = Some x2; n < 8\<rbrakk> \<Longrightarrow> ccorres dc xfdc (obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and valid_ipc_buffer_ptr' x2) \<lbrace>\<acute>i = 4 + word_of_nat n\<rbrace> (SKIP # hs) (storeWordUser (x2 + (5 + word_of_nat n) * word_size) (msg ! (4 + n))) (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds (if MessageID_Syscall <s 2 then UNIV else {}) (Guard ArrayBounds (if 0 \<le>s MessageID_Syscall then UNIV else {}) (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2 + (\<acute>i * 4 + 4))) \<acute>ret__unsigned_long))))))
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 0xC) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg))))
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (option_to_0 recvBuffer + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer + (\<acute>i * 4 + 4))) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; Suc n < length (drop (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace> case drop (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace>
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (drop (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' x y. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
 10. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (11 subgoals):
 1. \<And>x2 n. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length msg = 12; recvBuffer = Some x2; n < 8\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1777 x2 n) (?Q'1777 x2 n) (SKIP # hs) (storeWordUser (x2 + (5 + word_of_nat n) * word_size) (msg ! (4 + n))) (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds (if MessageID_Syscall <s 2 then UNIV else {}) (Guard ArrayBounds (if 0 \<le>s MessageID_Syscall then UNIV else {}) (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2 + (\<acute>i * 4 + 4))) \<acute>ret__unsigned_long))))))
 2. \<And>x2 n s s'. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length msg = 12; recvBuffer = Some x2; n < 8; (s, s') \<in> rf_sr; (obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and valid_ipc_buffer_ptr' x2) s; s' \<in> \<lbrace>\<acute>i = 4 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ?Q1777 x2 n s \<and> s' \<in> ?Q'1777 x2 n
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 0xC) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg))))
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (option_to_0 recvBuffer + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer + (\<acute>i * 4 + 4))) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; Suc n < length (drop (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace> case drop (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace>
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (drop (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' x y. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 10. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x2 n. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length msg = 12; recvBuffer = Some x2; n < 8\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1780 x2 n) (?Q'1777 x2 n) (SKIP # hs) (do _ <- asUser sender (getRegister (FaultHandler_H.syscallMessage ! (n + unat n_msgRegisters)));
storeWordUser (x2 + (5 + word_of_nat n) * word_size) (msg ! (4 + n))
od) (Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds (if MessageID_Syscall <s 2 then UNIV else {}) (Guard ArrayBounds (if 0 \<le>s MessageID_Syscall then UNIV else {}) (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2 + (\<acute>i * 4 + 4))) \<acute>ret__unsigned_long))))))
 2. \<And>x2 n s s'. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length msg = 12; recvBuffer = Some x2; n < 8; (s, s') \<in> rf_sr; (obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and valid_ipc_buffer_ptr' x2) s; s' \<in> \<lbrace>\<acute>i = 4 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (?P1780 x2 n and tcb_at' sender) s \<and> s' \<in> ?Q'1777 x2 n
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 0xC) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg))))
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (option_to_0 recvBuffer + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer + (\<acute>i * 4 + 4))) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; Suc n < length (drop (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace> case drop (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace>
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (drop (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' x y. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 10. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x2 n rv ret__unsigned_long. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length msg = 12; recvBuffer = Some x2; n < 8; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1786 x2 n rv) (?Q'1786 x2 n rv ret__unsigned_long) (SKIP # hs) (storeWordUser (x2 + (5 + word_of_nat n) * word_size) (msg ! (4 + n))) (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2 + (\<acute>i * 4 + 4))) ret__unsigned_long))))))
 2. \<And>x2 n. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length msg = 12; recvBuffer = Some x2; n < 8\<rbrakk> \<Longrightarrow> \<lbrace>?R1786 x2 n\<rbrace> asUser sender (getRegister (FaultHandler_H.syscallMessage ! (n + unat n_msgRegisters))) \<lbrace>?Q1786 x2 n\<rbrace>
 3. \<And>x2 n s s'. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length msg = 12; recvBuffer = Some x2; n < 8; (s, s') \<in> rf_sr; (obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and valid_ipc_buffer_ptr' x2) s; s' \<in> \<lbrace>\<acute>i = 4 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1786 x2 n and tcb_at' sender) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (FaultHandler_H.syscallMessage ! (n + unat n_msgRegisters))\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> ?Q'1786 x2 n rv (ret__unsigned_long_' t)} \<inter> (if 0 \<le>s MessageID_Syscall then UNIV else {}) \<inter> (if MessageID_Syscall <s 2 then UNIV else {}) \<inter> \<lbrace>\<acute>i < 0xC\<rbrace>
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 0xC) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg))))
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (option_to_0 recvBuffer + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer + (\<acute>i * 4 + 4))) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; Suc n < length (drop (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace> case drop (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace>
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (drop (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' x y. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 10. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x2 n rv ret__unsigned_long. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length msg = 12; recvBuffer = Some x2; n < 8; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'1838 x2 n rv) (?Q1834 x2 n rv ret__unsigned_long) (SKIP # hs) (storeWordUser (x2 + (5 + word_of_nat n) * word_size) (msg ! (4 + n))) (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2 + (\<acute>i * 4 + 4))) ret__unsigned_long))))))
 2. \<And>x2 n. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length msg = 12; recvBuffer = Some x2; n < 8\<rbrakk> \<Longrightarrow> \<lbrace>?R1786 x2 n\<rbrace> asUser sender (getRegister (FaultHandler_H.syscallMessage ! (n + unat n_msgRegisters))) \<lbrace>\<lambda>rv. (\<lambda>s. rv = msg ! (n + unat n_msgRegisters)) and ?P'1838 x2 n rv\<rbrace>
 3. \<And>x2 n s s'. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length msg = 12; recvBuffer = Some x2; n < 8; (s, s') \<in> rf_sr; (obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and valid_ipc_buffer_ptr' x2) s; s' \<in> \<lbrace>\<acute>i = 4 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1786 x2 n and tcb_at' sender) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (FaultHandler_H.syscallMessage ! (n + unat n_msgRegisters))\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> rv = msg ! (n + unat n_msgRegisters) \<longrightarrow> s' \<in> ?Q1834 x2 n rv (ret__unsigned_long_' t)}} \<inter> (if 0 \<le>s MessageID_Syscall then UNIV else {}) \<inter> (if MessageID_Syscall <s 2 then UNIV else {}) \<inter> \<lbrace>\<acute>i < 0xC\<rbrace>
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 0xC) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg))))
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (option_to_0 recvBuffer + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer + (\<acute>i * 4 + 4))) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; Suc n < length (drop (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace> case drop (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace>
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (drop (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' x y. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 10. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x2 n rv ret__unsigned_long. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length msg = 12; recvBuffer = Some x2; n < 8; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A1846 x2 n rv) (?C'1845 x2 n rv ret__unsigned_long) (SKIP # hs) (storeWordUser (x2 + (5 + word_of_nat n) * word_size) (msg ! (4 + n))) (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2 + (\<acute>i * 4 + 4))) ret__unsigned_long))))
 2. \<And>x2 n. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length msg = 12; recvBuffer = Some x2; n < 8\<rbrakk> \<Longrightarrow> \<lbrace>?R1786 x2 n\<rbrace> asUser sender (getRegister (FaultHandler_H.syscallMessage ! (n + unat n_msgRegisters))) \<lbrace>\<lambda>rv. (\<lambda>s. rv = msg ! (n + unat n_msgRegisters)) and (?A1846 x2 n rv and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)))\<rbrace>
 3. \<And>x2 n s s'. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length msg = 12; recvBuffer = Some x2; n < 8; (s, s') \<in> rf_sr; (obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and valid_ipc_buffer_ptr' x2) s; s' \<in> \<lbrace>\<acute>i = 4 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1786 x2 n and tcb_at' sender) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (FaultHandler_H.syscallMessage ! (n + unat n_msgRegisters))\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> rv = msg ! (n + unat n_msgRegisters) \<longrightarrow> s' \<in> ?C'1845 x2 n rv (ret__unsigned_long_' t) \<inter> \<lbrace>Suc (unat (\<acute>i + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> Suc (unat (\<acute>i + 1)) \<noteq> 0)\<rbrace> \<inter> \<lbrace>unat (\<acute>i + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> unat (\<acute>i + 1) \<noteq> 0)\<rbrace>}} \<inter> (if 0 \<le>s MessageID_Syscall then UNIV else {}) \<inter> (if MessageID_Syscall <s 2 then UNIV else {}) \<inter> \<lbrace>\<acute>i < 0xC\<rbrace>
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 0xC) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg))))
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (option_to_0 recvBuffer + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer + (\<acute>i * 4 + 4))) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; Suc n < length (drop (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace> case drop (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace>
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (drop (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' x y. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 10. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x2 n rv ret__unsigned_long. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length msg = 12; recvBuffer = Some x2; n < 8; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A1846 x2 n ret__unsigned_long) (?C'1845 x2 n ret__unsigned_long ret__unsigned_long) (SKIP # hs) (do y <- stateAssert (pointerInUserData (x2 + (5 + word_of_nat n) * word_size)) [];
doMachineOp (storeWord (x2 + (5 + word_of_nat n) * word_size) (msg ! (4 + n)))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2 + (\<acute>i * 4 + 4))) ret__unsigned_long))))
 2. \<And>x2 n. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length msg = 12; recvBuffer = Some x2; n < 8\<rbrakk> \<Longrightarrow> \<lbrace>?R1786 x2 n\<rbrace> asUser sender (getRegister (FaultHandler_H.syscallMessage ! (n + unat n_msgRegisters))) \<lbrace>\<lambda>rv. (\<lambda>s. rv = msg ! (n + unat n_msgRegisters)) and (?A1846 x2 n rv and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)))\<rbrace>
 3. \<And>x2 n s s'. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length msg = 12; recvBuffer = Some x2; n < 8; (s, s') \<in> rf_sr; (obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and valid_ipc_buffer_ptr' x2) s; s' \<in> \<lbrace>\<acute>i = 4 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1786 x2 n and tcb_at' sender) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (FaultHandler_H.syscallMessage ! (n + unat n_msgRegisters))\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> rv = msg ! (n + unat n_msgRegisters) \<longrightarrow> s' \<in> ?C'1845 x2 n rv (ret__unsigned_long_' t) \<inter> \<lbrace>Suc (unat (\<acute>i + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> Suc (unat (\<acute>i + 1)) \<noteq> 0)\<rbrace> \<inter> \<lbrace>unat (\<acute>i + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> unat (\<acute>i + 1) \<noteq> 0)\<rbrace>}} \<inter> (if 0 \<le>s MessageID_Syscall then UNIV else {}) \<inter> (if MessageID_Syscall <s 2 then UNIV else {}) \<inter> \<lbrace>\<acute>i < 0xC\<rbrace>
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 0xC) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg))))
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (option_to_0 recvBuffer + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer + (\<acute>i * 4 + 4))) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; Suc n < length (drop (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace> case drop (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace>
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (drop (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' x y. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 10. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x2 n rv ret__unsigned_long y. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length msg = 12; recvBuffer = Some x2; n < 8; rv = ret__unsigned_long\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1859 x2 n ret__unsigned_long ret__unsigned_long y) (?Q'1857 x2 n ret__unsigned_long ret__unsigned_long y) (SKIP # hs) (doMachineOp (storeWord (x2 + (5 + word_of_nat n) * word_size) (msg ! (4 + n)))) (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2 + (\<acute>i * 4 + 4))) ret__unsigned_long))))
 2. \<And>x2 n. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length msg = 12; recvBuffer = Some x2; n < 8\<rbrakk> \<Longrightarrow> \<lbrace>?R1786 x2 n\<rbrace> asUser sender (getRegister (FaultHandler_H.syscallMessage ! (n + unat n_msgRegisters))) \<lbrace>\<lambda>rv. (\<lambda>s. rv = msg ! (n + unat n_msgRegisters)) and ((\<lambda>a. pointerInUserData (x2 + (5 + word_of_nat n) * word_size) a \<longrightarrow> ?Q1859 x2 n rv rv () a) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)))\<rbrace>
 3. \<And>x2 n s s'. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length msg = 12; recvBuffer = Some x2; n < 8; (s, s') \<in> rf_sr; (obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and valid_ipc_buffer_ptr' x2) s; s' \<in> \<lbrace>\<acute>i = 4 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1786 x2 n and tcb_at' sender) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (FaultHandler_H.syscallMessage ! (n + unat n_msgRegisters))\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> rv = msg ! (n + unat n_msgRegisters) \<longrightarrow> s' \<in> {s'. \<forall>rva s. (s, s') \<in> rf_sr \<and> ?Q1859 x2 n rv (ret__unsigned_long_' t) rva s \<longrightarrow> s' \<in> ?Q'1857 x2 n rv (ret__unsigned_long_' t) rva} \<inter> \<lbrace>Suc (unat (\<acute>i + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> Suc (unat (\<acute>i + 1)) \<noteq> 0)\<rbrace> \<inter> \<lbrace>unat (\<acute>i + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> unat (\<acute>i + 1) \<noteq> 0)\<rbrace>}} \<inter> (if 0 \<le>s MessageID_Syscall then UNIV else {}) \<inter> (if MessageID_Syscall <s 2 then UNIV else {}) \<inter> \<lbrace>\<acute>i < 0xC\<rbrace>
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 0xC) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg))))
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (option_to_0 recvBuffer + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer + (\<acute>i * 4 + 4))) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; Suc n < length (drop (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace> case drop (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace>
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (drop (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' x y. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 10. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x2 n. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length msg = 12; recvBuffer = Some x2; n < 8\<rbrakk> \<Longrightarrow> \<lbrace>?R1786 x2 n\<rbrace> asUser sender (getRegister (FaultHandler_H.syscallMessage ! (n + unat n_msgRegisters))) \<lbrace>\<lambda>rv. (\<lambda>s. rv = msg ! (n + unat n_msgRegisters)) and ((\<lambda>a. pointerInUserData (x2 + (5 + word_of_nat n) * word_size) a \<longrightarrow> (valid_pspace' and K (is_aligned (x2 + (5 + word_of_nat n) * word_size) 2) and pointerInUserData (x2 + (5 + word_of_nat n) * word_size)) a) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)))\<rbrace>
 2. \<And>x2 n s s'. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length msg = 12; recvBuffer = Some x2; n < 8; (s, s') \<in> rf_sr; (obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and valid_ipc_buffer_ptr' x2) s; s' \<in> \<lbrace>\<acute>i = 4 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1786 x2 n and tcb_at' sender) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (FaultHandler_H.syscallMessage ! (n + unat n_msgRegisters))\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> rv = msg ! (n + unat n_msgRegisters) \<longrightarrow> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_pspace' and K (is_aligned (x2 + (5 + word_of_nat n) * word_size) 2) and pointerInUserData (x2 + (5 + word_of_nat n) * word_size)) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>PTR(32 word) (x2 + (\<acute>i * 4 + 4)) = PTR(32 word) (x2 + (5 + word_of_nat n) * word_size)\<rbrace> \<inter> \<lbrace>c_guard (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))\<rbrace> \<inter> \<lbrace>\<^bsup>t\<^esup>ret__unsigned_long = msg ! (4 + n)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))}} \<inter> \<lbrace>Suc (unat (\<acute>i + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> Suc (unat (\<acute>i + 1)) \<noteq> 0)\<rbrace> \<inter> \<lbrace>unat (\<acute>i + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> unat (\<acute>i + 1) \<noteq> 0)\<rbrace>}} \<inter> (if 0 \<le>s MessageID_Syscall then UNIV else {}) \<inter> (if MessageID_Syscall <s 2 then UNIV else {}) \<inter> \<lbrace>\<acute>i < 0xC\<rbrace>
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 0xC) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg))))
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (option_to_0 recvBuffer + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer + (\<acute>i * 4 + 4))) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; Suc n < length (drop (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace> case drop (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace>
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (drop (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' x y. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 10. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x2 n. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length msg = 12; recvBuffer = Some x2; n < 8\<rbrakk> \<Longrightarrow> \<lbrace>?R1786 x2 n\<rbrace> asUser sender (getRegister (FaultHandler_H.syscallMessage ! (n + unat n_msgRegisters))) \<lbrace>\<lambda>rv x. rv = msg ! (n + unat n_msgRegisters) \<and> (pointerInUserData (x2 + (5 + word_of_nat n) * word_size) x \<longrightarrow> valid_pspace' x \<and> is_aligned (x2 + (5 + word_of_nat n) * word_size) 2) \<and> valid_ipc_buffer_ptr' x2 x\<rbrace>
 2. \<And>x2 n s s'. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length msg = 12; recvBuffer = Some x2; n < 8; (s, s') \<in> rf_sr; (obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and valid_ipc_buffer_ptr' x2) s; s' \<in> \<lbrace>\<acute>i = 4 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?R1786 x2 n and tcb_at' sender) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (FaultHandler_H.syscallMessage ! (n + unat n_msgRegisters))\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> rv = msg ! (n + unat n_msgRegisters) \<longrightarrow> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_pspace' and K (is_aligned (x2 + (5 + word_of_nat n) * word_size) 2) and pointerInUserData (x2 + (5 + word_of_nat n) * word_size)) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>PTR(32 word) (x2 + (\<acute>i * 4 + 4)) = PTR(32 word) (x2 + (5 + word_of_nat n) * word_size)\<rbrace> \<inter> \<lbrace>c_guard (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))\<rbrace> \<inter> \<lbrace>\<^bsup>t\<^esup>ret__unsigned_long = msg ! (4 + n)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))}} \<inter> \<lbrace>Suc (unat (\<acute>i + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> Suc (unat (\<acute>i + 1)) \<noteq> 0)\<rbrace> \<inter> \<lbrace>unat (\<acute>i + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> unat (\<acute>i + 1) \<noteq> 0)\<rbrace>}} \<inter> (if 0 \<le>s MessageID_Syscall then UNIV else {}) \<inter> (if MessageID_Syscall <s 2 then UNIV else {}) \<inter> \<lbrace>\<acute>i < 0xC\<rbrace>
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 0xC) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg))))
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (option_to_0 recvBuffer + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer + (\<acute>i * 4 + 4))) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; Suc n < length (drop (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace> case drop (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace>
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (drop (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' x y. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 10. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>x2 n s s'. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length msg = 12; recvBuffer = Some x2; n < 8; (s, s') \<in> rf_sr; (obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and valid_ipc_buffer_ptr' x2) s; s' \<in> \<lbrace>\<acute>i = 4 + word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. obj_at' (\<lambda>tcb. (atcbContextGet \<circ> tcbArch) tcb (FaultHandler_H.syscallMessage ! (n + unat n_msgRegisters)) = msg ! (n + unat n_msgRegisters)) sender s \<and> (pointerInUserData (x2 + (5 + word_of_nat n) * word_size) s \<longrightarrow> valid_pspace' s \<and> is_aligned (x2 + (5 + word_of_nat n) * word_size) 2) \<and> valid_ipc_buffer_ptr' x2 s) and tcb_at' sender) s \<and> s' \<in> {s. reg_'_update (\<lambda>_. kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat (i_' s)]) (thread_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr sender) s) \<in> \<lbrace>\<acute>thread = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>reg = register_from_H (FaultHandler_H.syscallMessage ! (n + unat n_msgRegisters))\<rbrace>} \<inter> {s'. \<forall>t rv. rv = ret__unsigned_long_' t \<longrightarrow> s'\<lparr>globals := globals t, ret__unsigned_long_' := ret__unsigned_long_' t\<rparr> \<in> {s'. \<forall>s. (s, s') \<in> rf_sr \<and> rv = msg ! (n + unat n_msgRegisters) \<longrightarrow> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_pspace' and K (is_aligned (x2 + (5 + word_of_nat n) * word_size) 2) and pointerInUserData (x2 + (5 + word_of_nat n) * word_size)) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>PTR(32 word) (x2 + (\<acute>i * 4 + 4)) = PTR(32 word) (x2 + (5 + word_of_nat n) * word_size)\<rbrace> \<inter> \<lbrace>c_guard (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))\<rbrace> \<inter> \<lbrace>\<^bsup>t\<^esup>ret__unsigned_long = msg ! (4 + n)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))}} \<inter> \<lbrace>Suc (unat (\<acute>i + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> Suc (unat (\<acute>i + 1)) \<noteq> 0)\<rbrace> \<inter> \<lbrace>unat (\<acute>i + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> unat (\<acute>i + 1) \<noteq> 0)\<rbrace>}} \<inter> (if 0 \<le>s MessageID_Syscall then UNIV else {}) \<inter> (if MessageID_Syscall <s 2 then UNIV else {}) \<inter> \<lbrace>\<acute>i < 0xC\<rbrace>
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 0xC) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg))))
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (option_to_0 recvBuffer + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer + (\<acute>i * 4 + 4))) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; Suc n < length (drop (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace> case drop (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace>
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (drop (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' x y. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
 10. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (10 subgoals):
 1. \<And>x2 n s s'. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length msg = 12; recvBuffer = Some x2; n < 8; (s, s') \<in> rf_sr; i_' s' = 4 + word_of_nat n; obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender s; valid_pspace' s; valid_ipc_buffer_ptr' x2 s\<rbrakk> \<Longrightarrow> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (FaultHandler_H.syscallMessage ! (n + 4)) = msg ! (n + 4)) sender s \<and> (pointerInUserData (x2 + (0x14 + word_of_nat n * 4)) s \<longrightarrow> is_aligned (x2 + (0x14 + word_of_nat n * 4)) 2) \<and> tcb_at' sender s \<and> kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[4 + n] = kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[n + 4] \<and> (\<forall>t. (\<exists>s. (s, s'\<lparr>globals := globals t\<rparr>) \<in> rf_sr) \<and> ret__unsigned_long_' t = msg ! (n + 4) \<longrightarrow> ((\<exists>s. (s, s'\<lparr>globals := globals t\<rparr>) \<in> rf_sr \<and> valid_pspace' s \<and> is_aligned (x2 + (0x14 + word_of_nat n * 4)) 2 \<and> pointerInUserData (x2 + (0x14 + word_of_nat n * 4)) s) \<longrightarrow> c_guard (PTR(32 word) (x2 + (0x14 + word_of_nat n * 4))) \<and> s'\<lparr>globals := globals t, ret__unsigned_long_' := msg ! (n + 4)\<rparr> \<in> (if msg ! (n + 4) = msg ! (4 + n) then UNIV else {}) \<and> t \<Turnstile>\<^sub>c PTR(32 word) (x2 + (0x14 + word_of_nat n * 4))) \<and> 6 + n \<le> 2 ^ (msg_align_bits - 2) \<and> 5 + n \<le> 2 ^ (msg_align_bits - 2)) \<and> s' \<in> (if 0 \<le>s MessageID_Syscall then UNIV else {}) \<and> s' \<in> (if MessageID_Syscall <s 2 then UNIV else {}) \<and> 4 + word_of_nat n < 0xC
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 0xC) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg))))
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (option_to_0 recvBuffer + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer + (\<acute>i * 4 + 4))) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; Suc n < length (drop (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace> case drop (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace>
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (drop (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' x y. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
 10. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (10 subgoals):
 1. \<And>x2 n s s'. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length msg = 12; recvBuffer = Some x2; n < 8; (s, s') \<in> rf_sr; i_' s' = word_of_nat n + 4; obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender s; valid_pspace' s; valid_ipc_buffer_ptr' x2 s\<rbrakk> \<Longrightarrow> obj_at' (\<lambda>tcb. atcbContextGet (tcbArch tcb) (FaultHandler_H.syscallMessage ! (n + 4)) = msg ! (n + 4)) sender s \<and> (pointerInUserData (x2 + (0x14 + word_of_nat n * 4)) s \<longrightarrow> is_aligned (x2 + (0x14 + word_of_nat n * 4)) 2) \<and> tcb_at' sender s \<and> kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[n + 4] = kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[n + 4] \<and> (\<forall>t s. (s, s'\<lparr>globals := globals t\<rparr>) \<in> rf_sr \<longrightarrow> ret__unsigned_long_' t = msg ! (n + 4) \<longrightarrow> (\<forall>s. (s, s'\<lparr>globals := globals t\<rparr>) \<in> rf_sr \<longrightarrow> valid_pspace' s \<longrightarrow> is_aligned (x2 + (0x14 + word_of_nat n * 4)) 2 \<longrightarrow> pointerInUserData (x2 + (0x14 + word_of_nat n * 4)) s \<longrightarrow> c_guard (PTR(32 word) (x2 + (0x14 + word_of_nat n * 4))) \<and> s'\<lparr>globals := globals t, ret__unsigned_long_' := msg ! (n + 4)\<rparr> \<in> (if msg ! (n + 4) = msg ! (n + 4) then UNIV else {}) \<and> t \<Turnstile>\<^sub>c PTR(32 word) (x2 + (0x14 + word_of_nat n * 4))) \<and> n + 6 \<le> 2 ^ (msg_align_bits - 2) \<and> n + 5 \<le> 2 ^ (msg_align_bits - 2)) \<and> s' \<in> (if 0 \<le>s MessageID_Syscall then UNIV else {}) \<and> s' \<in> (if MessageID_Syscall <s 2 then UNIV else {}) \<and> word_of_nat n + 4 < 0xC
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 0xC) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg))))
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (option_to_0 recvBuffer + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer + (\<acute>i * 4 + 4))) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; Suc n < length (drop (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace> case drop (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace>
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (drop (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' x y. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
 10. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (10 subgoals):
 1. \<And>x2 n s s' obj. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length FaultHandler_H.syscallMessage = 12; recvBuffer = Some x2; n < 8; (s, s') \<in> rf_sr; i_' s' = word_of_nat n + 4; valid_pspace' s; valid_ipc_buffer_ptr' x2 s; ksPSpace s sender = Some (KOTCB obj); is_aligned sender tcbBlockSizeBits; ps_clear sender tcbBlockSizeBits s; msg = map (atcbContext (tcbArch obj)) FaultHandler_H.syscallMessage\<rbrakk> \<Longrightarrow> (pointerInUserData (x2 + (0x14 + word_of_nat n * 4)) s \<longrightarrow> is_aligned (x2 + (0x14 + word_of_nat n * 4)) 2) \<and> (\<forall>t. (\<exists>s. (s, s'\<lparr>globals := globals t\<rparr>) \<in> rf_sr) \<longrightarrow> ret__unsigned_long_' t = atcbContext (tcbArch obj) (FaultHandler_H.syscallMessage ! (n + 4)) \<longrightarrow> (\<forall>s. (s, s'\<lparr>globals := globals t\<rparr>) \<in> rf_sr \<longrightarrow> valid_pspace' s \<longrightarrow> is_aligned (x2 + (0x14 + word_of_nat n * 4)) 2 \<longrightarrow> pointerInUserData (x2 + (0x14 + word_of_nat n * 4)) s \<longrightarrow> t \<Turnstile>\<^sub>c PTR(32 word) (x2 + (0x14 + word_of_nat n * 4))) \<and> n + 6 \<le> 2 ^ (msg_align_bits - 2) \<and> n + 5 \<le> 2 ^ (msg_align_bits - 2)) \<and> s' \<in> (if 0 \<le>s MessageID_Syscall then UNIV else {}) \<and> s' \<in> (if MessageID_Syscall <s 2 then UNIV else {})
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 0xC) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg))))
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (option_to_0 recvBuffer + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer + (\<acute>i * 4 + 4))) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; Suc n < length (drop (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace> case drop (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace>
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (drop (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' x y. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
 10. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (10 subgoals):
 1. \<And>x2 n s s' obj. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length FaultHandler_H.syscallMessage = 12; recvBuffer = Some x2; n < 8; cstate_relation s (globals s'); i_' s' = word_of_nat n + 4; valid_pspace' s; ksPSpace s sender = Some (KOTCB obj); is_aligned sender tcbBlockSizeBits; ps_clear sender tcbBlockSizeBits s; msg = map (atcbContext (tcbArch obj)) FaultHandler_H.syscallMessage; is_aligned x2 9; typ_at' UserDataT (x2 && ~~ mask pageBits) s; pointerInUserData (x2 + (0x14 + word_of_nat n * 4)) s\<rbrakk> \<Longrightarrow> is_aligned (x2 + (0x14 + word_of_nat n * 4)) 2
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 0xC) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg))))
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (option_to_0 recvBuffer + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer + (\<acute>i * 4 + 4))) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; Suc n < length (drop (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace> case drop (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace>
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (drop (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' x y. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
 10. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (11 subgoals):
 1. \<And>x2 n s s' obj. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length FaultHandler_H.syscallMessage = 12; recvBuffer = Some x2; n < 8; cstate_relation s (globals s'); i_' s' = word_of_nat n + 4; valid_pspace' s; ksPSpace s sender = Some (KOTCB obj); is_aligned sender tcbBlockSizeBits; ps_clear sender tcbBlockSizeBits s; msg = map (atcbContext (tcbArch obj)) FaultHandler_H.syscallMessage; typ_at' UserDataT (x2 && ~~ mask pageBits) s; pointerInUserData (x2 + (0x14 + word_of_nat n * 4)) s\<rbrakk> \<Longrightarrow> is_aligned (0x14 + word_of_nat n * 4) 2
 2. \<And>x2 n s s' obj. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length FaultHandler_H.syscallMessage = 12; recvBuffer = Some x2; n < 8; cstate_relation s (globals s'); i_' s' = word_of_nat n + 4; valid_pspace' s; ksPSpace s sender = Some (KOTCB obj); is_aligned sender tcbBlockSizeBits; ps_clear sender tcbBlockSizeBits s; msg = map (atcbContext (tcbArch obj)) FaultHandler_H.syscallMessage; typ_at' UserDataT (x2 && ~~ mask pageBits) s; pointerInUserData (x2 + (0x14 + word_of_nat n * 4)) s\<rbrakk> \<Longrightarrow> 2 \<le> 9
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 0xC) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg))))
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (option_to_0 recvBuffer + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer + (\<acute>i * 4 + 4))) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; Suc n < length (drop (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace> case drop (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace>
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (drop (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' x y. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 10. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x2 n s s' obj. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length FaultHandler_H.syscallMessage = 12; recvBuffer = Some x2; n < 8; cstate_relation s (globals s'); i_' s' = word_of_nat n + 4; valid_pspace' s; ksPSpace s sender = Some (KOTCB obj); is_aligned sender tcbBlockSizeBits; ps_clear sender tcbBlockSizeBits s; msg = map (atcbContext (tcbArch obj)) FaultHandler_H.syscallMessage; typ_at' UserDataT (x2 && ~~ mask pageBits) s; pointerInUserData (x2 + (0x14 + word_of_nat n * 4)) s\<rbrakk> \<Longrightarrow> is_aligned 0x14 2
 2. \<And>x2 n s s' obj. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length FaultHandler_H.syscallMessage = 12; recvBuffer = Some x2; n < 8; cstate_relation s (globals s'); i_' s' = word_of_nat n + 4; valid_pspace' s; ksPSpace s sender = Some (KOTCB obj); is_aligned sender tcbBlockSizeBits; ps_clear sender tcbBlockSizeBits s; msg = map (atcbContext (tcbArch obj)) FaultHandler_H.syscallMessage; typ_at' UserDataT (x2 && ~~ mask pageBits) s; pointerInUserData (x2 + (0x14 + word_of_nat n * 4)) s\<rbrakk> \<Longrightarrow> is_aligned (word_of_nat n * 4) 2
 3. \<And>x2 n s s' obj. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length FaultHandler_H.syscallMessage = 12; recvBuffer = Some x2; n < 8; cstate_relation s (globals s'); i_' s' = word_of_nat n + 4; valid_pspace' s; ksPSpace s sender = Some (KOTCB obj); is_aligned sender tcbBlockSizeBits; ps_clear sender tcbBlockSizeBits s; msg = map (atcbContext (tcbArch obj)) FaultHandler_H.syscallMessage; typ_at' UserDataT (x2 && ~~ mask pageBits) s; pointerInUserData (x2 + (0x14 + word_of_nat n * 4)) s\<rbrakk> \<Longrightarrow> 2 \<le> 2
 4. \<And>x2 n s s' obj. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length FaultHandler_H.syscallMessage = 12; recvBuffer = Some x2; n < 8; cstate_relation s (globals s'); i_' s' = word_of_nat n + 4; valid_pspace' s; ksPSpace s sender = Some (KOTCB obj); is_aligned sender tcbBlockSizeBits; ps_clear sender tcbBlockSizeBits s; msg = map (atcbContext (tcbArch obj)) FaultHandler_H.syscallMessage; typ_at' UserDataT (x2 && ~~ mask pageBits) s; pointerInUserData (x2 + (0x14 + word_of_nat n * 4)) s\<rbrakk> \<Longrightarrow> 2 \<le> 9
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 0xC) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg))))
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (option_to_0 recvBuffer + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer + (\<acute>i * 4 + 4))) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; Suc n < length (drop (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace> case drop (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace>
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (drop (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' x y. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 10. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x2 n s s' obj. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length FaultHandler_H.syscallMessage = 12; recvBuffer = Some x2; n < 8; cstate_relation s (globals s'); i_' s' = word_of_nat n + 4; valid_pspace' s; ksPSpace s sender = Some (KOTCB obj); is_aligned sender tcbBlockSizeBits; ps_clear sender tcbBlockSizeBits s; msg = map (atcbContext (tcbArch obj)) FaultHandler_H.syscallMessage; typ_at' UserDataT (x2 && ~~ mask pageBits) s; pointerInUserData (x2 + (0x14 + word_of_nat n * 4)) s\<rbrakk> \<Longrightarrow> is_aligned (word_of_nat n * 4) 2
 2. \<And>x2 n s s' obj. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length FaultHandler_H.syscallMessage = 12; recvBuffer = Some x2; n < 8; cstate_relation s (globals s'); i_' s' = word_of_nat n + 4; valid_pspace' s; ksPSpace s sender = Some (KOTCB obj); is_aligned sender tcbBlockSizeBits; ps_clear sender tcbBlockSizeBits s; msg = map (atcbContext (tcbArch obj)) FaultHandler_H.syscallMessage; typ_at' UserDataT (x2 && ~~ mask pageBits) s; pointerInUserData (x2 + (0x14 + word_of_nat n * 4)) s\<rbrakk> \<Longrightarrow> 2 \<le> 2
 3. \<And>x2 n s s' obj. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length FaultHandler_H.syscallMessage = 12; recvBuffer = Some x2; n < 8; cstate_relation s (globals s'); i_' s' = word_of_nat n + 4; valid_pspace' s; ksPSpace s sender = Some (KOTCB obj); is_aligned sender tcbBlockSizeBits; ps_clear sender tcbBlockSizeBits s; msg = map (atcbContext (tcbArch obj)) FaultHandler_H.syscallMessage; typ_at' UserDataT (x2 && ~~ mask pageBits) s; pointerInUserData (x2 + (0x14 + word_of_nat n * 4)) s\<rbrakk> \<Longrightarrow> 2 \<le> 9
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 0xC) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg))))
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (option_to_0 recvBuffer + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer + (\<acute>i * 4 + 4))) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; Suc n < length (drop (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace> case drop (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace>
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (drop (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' x y. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 10. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x2 n s s' obj. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length FaultHandler_H.syscallMessage = 12; recvBuffer = Some x2; n < 8; cstate_relation s (globals s'); i_' s' = word_of_nat n + 4; valid_pspace' s; ksPSpace s sender = Some (KOTCB obj); is_aligned sender tcbBlockSizeBits; ps_clear sender tcbBlockSizeBits s; msg = map (atcbContext (tcbArch obj)) FaultHandler_H.syscallMessage; typ_at' UserDataT (x2 && ~~ mask pageBits) s; pointerInUserData (x2 + (0x14 + word_of_nat n * 4)) s\<rbrakk> \<Longrightarrow> 2 \<le> 2
 2. \<And>x2 n s s' obj. \<lbrakk>x2 \<noteq> 0; sender \<noteq> receiver; length FaultHandler_H.syscallMessage = 12; recvBuffer = Some x2; n < 8; cstate_relation s (globals s'); i_' s' = word_of_nat n + 4; valid_pspace' s; ksPSpace s sender = Some (KOTCB obj); is_aligned sender tcbBlockSizeBits; ps_clear sender tcbBlockSizeBits s; msg = map (atcbContext (tcbArch obj)) FaultHandler_H.syscallMessage; typ_at' UserDataT (x2 && ~~ mask pageBits) s; pointerInUserData (x2 + (0x14 + word_of_nat n * 4)) s\<rbrakk> \<Longrightarrow> 2 \<le> 9
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 0xC) = (n < word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg))))
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (option_to_0 recvBuffer + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer + (\<acute>i * 4 + 4))) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; Suc n < length (drop (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace> case drop (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace>
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (drop (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' x y. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 10. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
A total of 11 subgoals... proof (prove)
goal (9 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> (n < 0xC) = (n < UCAST(32 signed \<rightarrow> 32) n_msgRegisters + word_of_nat (12 - unat n_msgRegisters))
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (option_to_0 recvBuffer + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer + (\<acute>i * 4 + 4))) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; Suc n < length (drop (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace> case drop (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace>
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (drop (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' x y. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
 9. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (8 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 0xC\<rbrace> (Guard ArrayBounds \<lbrace>MessageID_Syscall <s 2\<rbrace> (Guard ArrayBounds \<lbrace>0 \<le>s MessageID_Syscall\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.fault_messages.[unat MessageID_Syscall].[unat \<acute>i]))));;
Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (option_to_0 recvBuffer + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer + (\<acute>i * 4 + 4))) \<acute>ret__unsigned_long))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; Suc n < length (drop (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace> case drop (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace>
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (drop (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' x y. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (8 subgoals):
 1. \<And>t_hrs i. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> i < 0xC \<longrightarrow> MessageID_Syscall <s 2 \<longrightarrow> 0 \<le>s MessageID_Syscall \<longrightarrow> i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (i + 1)) (hrs_htd t_hrs) \<longrightarrow> hrs_htd t_hrs \<Turnstile>\<^sub>t PTR(32 word) (option_to_0 recvBuffer + (i * 4 + 4)) \<longrightarrow> i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (i + 1))) (hrs_htd t_hrs) \<longrightarrow> i = i
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; Suc n < length (drop (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace> case drop (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace>
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (drop (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' x y. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (7 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; Suc n < length (drop (unat n_msgRegisters) (zip [0..<120] msg))\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace> case drop (unat n_msgRegisters) (zip [0..<120] msg) ! n of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace>
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (drop (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' x y. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (7 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = 4; option_to_0 recvBuffer \<noteq> 0; n < 7\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace> case recvBuffer of None \<Rightarrow> return (length TCB_H.msgRegisters) | Some buf \<Rightarrow> do storeWordUser (buf + word_of_nat (4 + n + 1) * word_size) (msg ! (4 + n));
return (4 + n + 1)
od \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace>
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (drop (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' x y. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (8 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = 4; option_to_0 recvBuffer \<noteq> 0; n < 7\<rbrakk> \<Longrightarrow> \<lbrace>?Q1950 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n\<rbrace> case recvBuffer of None \<Rightarrow> return (length TCB_H.msgRegisters) | Some buf \<Rightarrow> do storeWordUser (buf + word_of_nat (4 + n + 1) * word_size) (msg ! (4 + n));
return (4 + n + 1)
od \<lbrace>\<lambda>_. obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)\<rbrace>
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n s. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = 4; option_to_0 recvBuffer \<noteq> 0; n < 7; (obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s\<rbrakk> \<Longrightarrow> ?Q1950 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n s
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (drop (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' x y. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
 8. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (7 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' n s. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = 4; option_to_0 recvBuffer \<noteq> 0; n < 7; (obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s\<rbrakk> \<Longrightarrow> (recvBuffer = None \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender s \<and> valid_pspace' s \<and> (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s) \<and> (\<forall>x. recvBuffer = Some x \<longrightarrow> obj_at' (\<lambda>a. map (atcbContext (tcbArch a)) FaultHandler_H.syscallMessage = msg) sender s \<and> valid_pspace' s \<and> (case recvBuffer of None \<Rightarrow> \<lambda>s. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s)
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (drop (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' x y. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
 7. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (6 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> unat n_msgRegisters + length (drop (unat n_msgRegisters) (zip [0..<120] msg)) < 2 ^ word_bits
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' x y. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
 6. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (5 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv' x y. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer \<noteq> 0; i_' y = word_of_nat (unat n_msgRegisters) + word_of_nat (length (drop (unat n_msgRegisters) (zip [0..<120] msg)))\<rbrakk> \<Longrightarrow> dc x (xfdc y)
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
 5. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg))); \<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv) (?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv') (SKIP # hs) (mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = NULL; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer = 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) ()) (?T1740 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () (word_of_nat (min 12 (unat n_msgRegisters)))) (SKIP # hs) (mapM_x (\<lambda>(x, y). setMR receiver recvBuffer x y) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = NULL; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer = 0; recvBuffer = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R1744 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) ()) (?T1740 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () (word_of_nat (min 12 (unat n_msgRegisters)))) (SKIP # hs) (mapM_x (\<lambda>(x, y). setMR receiver recvBuffer x y) (drop (unat n_msgRegisters) (zip [0..<120] msg))) SKIP
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = NULL; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer = 0; recvBuffer = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2004 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) ()) (?T2005 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () (word_of_nat (min 12 (unat n_msgRegisters)))) (SKIP # hs) (mapM_x (\<lambda>(x, y). setMR receiver recvBuffer x y) (zip (drop (unat n_msgRegisters) [0..<120]) (drop (unat n_msgRegisters) msg))) SKIP
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV
flex-flex pairs:
?T2005 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () (word_of_nat (min 12 (unat n_msgRegisters))) \<equiv>\<^sup>? ?T1740 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () (word_of_nat (min 12 (unat n_msgRegisters)))
?R2004 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () \<equiv>\<^sup>? ?R1744 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () proof (prove)
goal (4 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = NULL; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; rv' = word_of_nat (min 12 (unat n_msgRegisters)); option_to_0 recvBuffer = 0; recvBuffer = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2009 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) ()) (?T2010 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () (word_of_nat (min 12 (unat n_msgRegisters)))) (SKIP # hs) (mapM_x (\<lambda>(x, y). setMR receiver recvBuffer x y) (zip [unat n_msgRegisters..<120] (drop (unat n_msgRegisters) msg))) SKIP
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV
flex-flex pairs:
?T2010 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () (word_of_nat (min 12 (unat n_msgRegisters))) \<equiv>\<^sup>? ?T2005 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () (word_of_nat (min 12 (unat n_msgRegisters)))
?R2009 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () \<equiv>\<^sup>? ?R2004 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) ()
?T2005 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () (word_of_nat (min 12 (unat n_msgRegisters))) \<equiv>\<^sup>? ?T1740 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () (word_of_nat (min 12 (unat n_msgRegisters)))
?R2004 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () \<equiv>\<^sup>? ?R1744 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () proof (prove)
goal (4 subgoals):
 1. \<lbrakk>sender \<noteq> receiver; length msg = 12; recvBuffer = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2009 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) ()) (?T2010 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () 4) (SKIP # hs) (mapM_x (\<lambda>p. return (length TCB_H.msgRegisters)) (zip [Suc (Suc (Suc (Suc 0)))..<120] (drop (Suc (Suc (Suc (Suc 0)))) msg))) SKIP
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV
flex-flex pairs:
?T2010 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () (word_of_nat (min 12 (unat n_msgRegisters))) \<equiv>\<^sup>? ?T2005 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () (word_of_nat (min 12 (unat n_msgRegisters)))
?R2009 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () \<equiv>\<^sup>? ?R2004 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) ()
?T2005 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () (word_of_nat (min 12 (unat n_msgRegisters))) \<equiv>\<^sup>? ?T1740 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () (word_of_nat (min 12 (unat n_msgRegisters)))
?R2004 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () \<equiv>\<^sup>? ?R1744 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () proof (prove)
goal (4 subgoals):
 1. \<lbrakk>sender \<noteq> receiver; length msg = 12; recvBuffer = None\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R2036 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) ()) (?T2036 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () 4) (SKIP # hs) (return ()) SKIP
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> ?R1744 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv s)\<rbrace>
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> ?T1740 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera rv rv')})
 4. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV
flex-flex pairs:
?T2036 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () 4 \<equiv>\<^sup>? ?T2010 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () 4
?R2036 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () \<equiv>\<^sup>? ?R2009 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) ()
?T2010 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () (word_of_nat (min 12 (unat n_msgRegisters))) \<equiv>\<^sup>? ?T2005 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () (word_of_nat (min 12 (unat n_msgRegisters)))
?R2009 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () \<equiv>\<^sup>? ?R2004 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) ()
?T2005 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () (word_of_nat (min 12 (unat n_msgRegisters))) \<equiv>\<^sup>? ?T1740 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () (word_of_nat (min 12 (unat n_msgRegisters)))
?R2004 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () \<equiv>\<^sup>? ?R1744 MessageID_Syscall 0xC NULL (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) () proof (prove)
goal (3 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>a. case a of (a, b) \<Rightarrow> setMR receiver recvBuffer a b) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> (obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender and valid_pspace' and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> True)\<rbrace>
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> UNIV)})
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (3 subgoals):
 1. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>(x, y). setMR receiver recvBuffer x y) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. option_to_0 recvBuffer \<noteq> 0 \<longrightarrow> obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender s \<and> valid_pspace' s \<and> (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s\<rbrace>
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> UNIV)})
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (3 subgoals):
 1. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R1393 MessageID_Syscall 0xC (PTR(32 word) (option_to_0 recvBuffer)) (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender)\<rbrace> mapM_x (\<lambda>(x, y). setMR receiver recvBuffer x y) (take (unat n_msgRegisters) (zip [0..<120] msg)) \<lbrace>\<lambda>rv s. obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender s \<and> valid_pspace' s \<and> (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s\<rbrace>
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> UNIV)})
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and ?R1393 id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera) s \<and> s' \<in> UNIV proof (prove)
goal (3 subgoals):
 1. \<And>x. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; option_to_0 recvBuffer \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender a \<and> valid_pspace' a \<and> (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a\<rbrace> case x of (a, b) \<Rightarrow> setMR receiver recvBuffer a b \<lbrace>\<lambda>rv a. obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender a \<and> valid_pspace' a \<and> (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a\<rbrace>
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> UNIV)})
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender a \<and> valid_pspace' a \<and> (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a)) s \<and> s' \<in> UNIV proof (prove)
goal (3 subgoals):
 1. \<And>x a. \<lbrakk>sender \<noteq> receiver; a \<noteq> 0; length msg = 12; recvBuffer = Some a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>b. obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender b \<and> valid_pspace' b \<and> valid_ipc_buffer_ptr' a b\<rbrace> setMR receiver (Some a) (fst x) (snd x) \<lbrace>\<lambda>rv b. obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender b \<and> valid_pspace' b \<and> valid_ipc_buffer_ptr' a b\<rbrace>
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> UNIV)})
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender a \<and> valid_pspace' a \<and> (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a)) s \<and> s' \<in> UNIV proof (prove)
goal (3 subgoals):
 1. \<And>x a. \<lbrakk>a \<noteq> 0; length msg = 12; recvBuffer = Some a\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. valid_pspace' s \<and> valid_ipc_buffer_ptr' a s\<rbrace> setMR receiver (Some a) (fst x) (snd x) \<lbrace>\<lambda>rv s. valid_pspace' s \<and> valid_ipc_buffer_ptr' a s\<rbrace>
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> UNIV)})
 3. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender a \<and> valid_pspace' a \<and> (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a)) s \<and> s' \<in> UNIV proof (prove)
goal (2 subgoals):
 1. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n_msgRegisters) (zip [0..<120] msg)))) i_' (\<lambda>rv rv'. {s. (PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> \<lbrace>\<acute>i = word_of_nat (unat n_msgRegisters)\<rbrace>) \<and> (\<not> PTR(32 word) (option_to_0 recvBuffer) \<noteq> NULL \<longrightarrow> s \<in> UNIV)})
 2. \<And>id___anonymous_enum length___unsigned_long receiveIPCBuffer receivera sendera s s'. \<lbrakk>sender \<noteq> receiver; recvBuffer \<noteq> Some 0; length msg = 12; id___anonymous_enum = MessageID_Syscall; length___unsigned_long = 0xC; receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer); receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; (s, s') \<in> rf_sr; (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((K $ obj_at' (\<lambda>tcb. map ((atcbContext \<circ> tcbArch) tcb) FaultHandler_H.syscallMessage = msg) sender) 0 and (\<lambda>a. obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender a \<and> valid_pspace' a \<and> (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some a \<Rightarrow> valid_ipc_buffer_ptr' a) a)) s \<and> s' \<in> UNIV proof (prove)
goal:
No subgoals! proof (state)
this:
ccorres dc xfdc (valid_pspace' and obj_at' (\<lambda>tcb. map (atcbContext (tcbArch tcb)) FaultHandler_H.syscallMessage = msg) sender and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (length msg = 12) and K (recvBuffer \<noteq> Some 0) and K (sender \<noteq> receiver)) (UNIV \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace> \<inter> \<lbrace>\<acute>receiveIPCBuffer = PTR(32 word) (option_to_0 recvBuffer)\<rbrace> \<inter> \<lbrace>\<acute>length___unsigned_long = 0xC\<rbrace> \<inter> \<lbrace>\<acute>id___anonymous_enum = MessageID_Syscall\<rbrace>) hs (mapM_x (\<lambda>(x, y). setMR receiver recvBuffer x y) (zip [0..<120] msg)) (Call copyMRsFault_'proc)

goal:
No subgoals!