theory Ipc_C

lemma copyMRs_ccorres [corres]:
notes
  wordSize_def'[simp]
shows
  "ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_'
    (valid_pspace' and tcb_at' sender and tcb_at' receiver
        and (case sendBuffer of None \<Rightarrow> \<top> | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)
        and (case recvBuffer of None \<Rightarrow> \<top> | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)
        and K (sendBuffer \<noteq> Some 0) and K (recvBuffer \<noteq> Some 0)
        and K (unat n \<le> msgMaxLength))
    (UNIV \<inter> \<lbrace>\<acute>n = \<acute>n && mask msgLengthBits \<and> \<acute>n = n\<rbrace>
          \<inter> \<lbrace>\<acute>sendBuf = Ptr (option_to_0 sendBuffer)\<rbrace>
          \<inter> \<lbrace>\<acute>recvBuf = Ptr (option_to_0 recvBuffer)\<rbrace>
          \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace>
          \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>) []
    (copyMRs sender sendBuffer receiver recvBuffer n)
    (Call copyMRs_'proc)" apply (unfold K_def, intro ccorres_gen_asm) apply (cinit lift: n_' sendBuf_' recvBuf_' sender_' receiver_'
               simp: whileAnno_def) apply (simp only: mapM_discarded) apply (rule ccorres_rhs_assoc2) apply (rule_tac P = "length (take (unat n) ARM_H.msgRegisters) <
                        2 ^ word_bits"
                in ccorres_gen_asm) apply (rule ccorres_split_nothrow_novcg) apply (rule ccorres_mapM_x_while [OF copyMRs_register_loop_helper[unfolded ucast_id]]) apply (clarsimp simp: n_msgRegisters_def
                                length_msgRegisters min_def
                         split: if_split) apply unat_arith apply vcg apply simp apply wp apply assumption apply ceqv apply (wpc, simp add: option_to_0_def) apply (rule ccorres_split_throws, rule ccorres_return_C, simp+) apply vcg apply (wpc, simp_all add: option_to_0_def)[1] apply (rule ccorres_split_throws, rule ccorres_return_C, simp+) apply vcg apply (subst mapM_only_length) apply (rule_tac P="unat n \<le> length ARM_H.msgRegisters" in ccorres_cases) apply (simp add: upto_enum_def length_msgRegisters n_msgRegisters_def
                       mapM_x_Nil) apply (rule ccorres_expand_while_iff_Seq[THEN iffD1]) apply (rule ccorres_cond_false) apply (rule ccorres_return_C, simp+) apply (rule ccorres_split_nothrow_novcg) apply (rule_tac i="length ARM_H.msgRegisters"
               and F="\<lambda>_. valid_ipc_buffer_ptr' (the sendBuffer)
                 and valid_ipc_buffer_ptr' (the recvBuffer)
                 and valid_pspace'"
               in ccorres_mapM_x_while') apply clarsimp apply (rule ccorres_guard_imp) apply (rule ccorres_pre_loadWordUser) apply (unfold storeWordUser_def) apply (rule ccorres_pre_stateAssert) apply (unfold K_bind_def) apply (rule ccorres_move_array_assertion_ipc_buffer
                           ccorres_Guard[where S="{s. h_t_valid (htd s) c_guard (ptr s)}" for ptr htd])+ apply (ctac add: storeWord_ccorres) apply (clarsimp simp: word_size valid_ipc_buffer_ptr'_def
                                    msg_align_bits
                                    aligned_add_aligned[OF _ is_aligned_mult_triv2[where n=2, simplified]]) apply (clarsimp simp: msgRegisters_unfold upto_enum_word word_size
                                   pointerInUserData_h_t_valid pointerInUserData_c_guard
                                   typ_heap_simps'
                split: if_split_asm simp del: upt.simps) apply (simp only: unat_arith_simps unat_of_nat msg_align_bits
                               msgMaxLength_def, simp split: if_split) apply arith apply (simp add: n_msgRegisters_def length_msgRegisters) apply (rule allI, rule conseqPre, vcg) apply clarsimp apply (rule hoare_pre, wpsimp wp: hoare_valid_ipc_buffer_ptr_typ_at') apply clarsimp apply (simp add: length_msgRegisters n_msgRegisters_def msgMaxLength_def
                          word_bits_def) apply ceqv apply simp apply (rule ccorres_return_C, simp_all)[1] apply wp apply clarsimp apply (clarsimp simp: guard_is_UNIV_def upto_enum_def
                           min_def word_le_nat_alt
                           length_msgRegisters n_msgRegisters_def
                           msgLengthBits_def mask_def
                           linorder_not_le) apply simp apply (wp mapM_x_wp' hoare_vcg_all_lift hoare_vcg_const_imp_lift | simp)+ apply (clarsimp simp: guard_is_UNIV_def
                         length_msgRegisters n_msgRegisters_def mask_def
                         Types_H.msgLengthBits_def min_def word_le_nat_alt
                  split: if_split) apply unat_arith apply (clarsimp simp: length_msgRegisters n_msgRegisters_def
                        msgLengthBits_def min_def word_bits_def) apply (auto split: if_split) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and K (sendBuffer \<noteq> Some 0) and K (recvBuffer \<noteq> Some 0) and K (unat n \<le> msgMaxLength)) (UNIV \<inter> \<lbrace>\<acute>n = \<acute>n && mask msgLengthBits \<and> \<acute>n = n\<rbrace> \<inter> \<lbrace>\<acute>sendBuf = PTR(32 word) (option_to_0 sendBuffer)\<rbrace> \<inter> \<lbrace>\<acute>recvBuf = PTR(32 word) (option_to_0 recvBuffer)\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>) [] (copyMRs sender sendBuffer receiver recvBuffer n) (Call copyMRs_'proc) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) (UNIV \<inter> \<lbrace>\<acute>n = \<acute>n && mask msgLengthBits \<and> \<acute>n = n\<rbrace> \<inter> \<lbrace>\<acute>sendBuf = PTR(32 word) (option_to_0 sendBuffer)\<rbrace> \<inter> \<lbrace>\<acute>recvBuf = PTR(32 word) (option_to_0 recvBuffer)\<rbrace> \<inter> \<lbrace>\<acute>sender = tcb_ptr_to_ctcb_ptr sender\<rbrace> \<inter> \<lbrace>\<acute>receiver = tcb_ptr_to_ctcb_ptr receiver\<rbrace>) [] (copyMRs sender sendBuffer receiver recvBuffer n) (Call copyMRs_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q1443 receivera sendera recvBuf sendBuf na) (?Q'1443 receivera sendera recvBuf sendBuf na) [SKIP] (do y <- mapM (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters);
bufferMRs <- case sendBuffer of None \<Rightarrow> return [] | Some sbPtr \<Rightarrow> case recvBuffer of None \<Rightarrow> return [] | Some rbPtr \<Rightarrow> mapM (\<lambda>x. loadWordUser (sbPtr + PPtr (x * 4)) >>= storeWordUser (rbPtr + PPtr (x * 4))) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. n];
return (min n (word_of_nat (min (length TCB_H.msgRegisters) (unat n)) + word_of_nat (length bufferMRs)))
od) (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < na \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(sendera,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(receivera,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF recvBuf = NULL \<or> sendBuf = NULL THEN
  return_C ret__unsigned_long_'_update i_'
FI;;
(While \<lbrace>\<acute>i < na\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion recvBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (recvBuf +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sendBuf (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (sendBuf +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion recvBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion sendBuf (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (recvBuf +\<^sub>p uint (\<acute>i + 1)) (h_val (hrs_mem \<acute>t_hrs) (sendBuf +\<^sub>p uint (\<acute>i + 1)))))))))));;
\<acute>i :== \<acute>i + 1);;
return_C ret__unsigned_long_'_update i_'))))
 2. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1443 receivera sendera recvBuf sendBuf na s \<and> s' \<in> ?Q'1443 receivera sendera recvBuf sendBuf na proof (prove)
goal (2 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q1443 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n) (?Q'1443 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n) [SKIP] (do _ <- mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters);
bufferMRs <- case sendBuffer of None \<Rightarrow> return [] | Some sbPtr \<Rightarrow> case recvBuffer of None \<Rightarrow> return [] | Some rbPtr \<Rightarrow> mapM (\<lambda>x. loadWordUser (sbPtr + PPtr (x * 4)) >>= storeWordUser (rbPtr + PPtr (x * 4))) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. n];
return (min n (word_of_nat (min (length TCB_H.msgRegisters) (unat n)) + word_of_nat (length bufferMRs)))
od) (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF PTR(32 word) (option_to_0 recvBuffer) = NULL \<or> PTR(32 word) (option_to_0 sendBuffer) = NULL THEN
  return_C ret__unsigned_long_'_update i_'
FI;;
(While \<lbrace>\<acute>i < n\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 sendBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 sendBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 sendBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (option_to_0 sendBuffer) +\<^sub>p uint (\<acute>i + 1)))))))))));;
\<acute>i :== \<acute>i + 1);;
return_C ret__unsigned_long_'_update i_'))))
 2. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1443 receivera sendera recvBuf sendBuf na s \<and> s' \<in> ?Q'1443 receivera sendera recvBuf sendBuf na proof (prove)
goal (2 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q1443 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n) (?Q'1443 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n) [SKIP] (do _ <- mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters);
bufferMRs <- case sendBuffer of None \<Rightarrow> return [] | Some sbPtr \<Rightarrow> case recvBuffer of None \<Rightarrow> return [] | Some rbPtr \<Rightarrow> mapM (\<lambda>x. loadWordUser (sbPtr + PPtr (x * 4)) >>= storeWordUser (rbPtr + PPtr (x * 4))) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. n];
return (min n (word_of_nat (min (length TCB_H.msgRegisters) (unat n)) + word_of_nat (length bufferMRs)))
od) (\<acute>i :== 0;;
While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF PTR(32 word) (option_to_0 recvBuffer) = NULL \<or> PTR(32 word) (option_to_0 sendBuffer) = NULL THEN
  return_C ret__unsigned_long_'_update i_'
FI;;
(While \<lbrace>\<acute>i < n\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 sendBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 sendBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 sendBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (option_to_0 sendBuffer) +\<^sub>p uint (\<acute>i + 1)))))))))));;
\<acute>i :== \<acute>i + 1);;
return_C ret__unsigned_long_'_update i_')))
 2. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1443 receivera sendera recvBuf sendBuf na s \<and> s' \<in> ?Q'1443 receivera sendera recvBuf sendBuf na proof (prove)
goal (2 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?G1456 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n) (?Q'1443 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n) [SKIP] (do _ <- mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters);
bufferMRs <- case sendBuffer of None \<Rightarrow> return [] | Some sbPtr \<Rightarrow> case recvBuffer of None \<Rightarrow> return [] | Some rbPtr \<Rightarrow> mapM (\<lambda>x. loadWordUser (sbPtr + PPtr (x * 4)) >>= storeWordUser (rbPtr + PPtr (x * 4))) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. n];
return (min n (word_of_nat (min (length TCB_H.msgRegisters) (unat n)) + word_of_nat (length bufferMRs)))
od) (\<acute>i :== 0;;
While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1);;
(IF PTR(32 word) (option_to_0 recvBuffer) = NULL \<or> PTR(32 word) (option_to_0 sendBuffer) = NULL THEN
  return_C ret__unsigned_long_'_update i_'
FI;;
(While \<lbrace>\<acute>i < n\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 sendBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 sendBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 sendBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (option_to_0 sendBuffer) +\<^sub>p uint (\<acute>i + 1)))))))))));;
\<acute>i :== \<acute>i + 1);;
return_C ret__unsigned_long_'_update i_')))
 2. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G1456 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> ?Q'1443 receivera sendera recvBuf sendBuf na proof (prove)
goal (6 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ccorres (?r'1458 receivera sendera recvBuf sendBuf na) (?xf'1458 receivera sendera recvBuf sendBuf na) (?P1466 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n) (?Q'1443 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n) [] (mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters)) (\<acute>i :== 0;;
While \<lbrace>\<acute>i < n \<and> \<acute>i < SCAST(32 signed \<rightarrow> 32) n_msgRegisters\<rbrace> (Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long));;
\<acute>i :== \<acute>i + 1))
 2. \<And>receivera sendera recvBuf sendBuf na rv' t t'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'1458 receivera sendera recvBuf sendBuf na) rv' t t' (IF PTR(32 word) (option_to_0 recvBuffer) = NULL \<or> PTR(32 word) (option_to_0 sendBuffer) = NULL THEN
  return_C ret__unsigned_long_'_update i_'
FI;;
(While \<lbrace>\<acute>i < n\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 sendBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 sendBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 sendBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (option_to_0 sendBuffer) +\<^sub>p uint (\<acute>i + 1)))))))))));;
\<acute>i :== \<acute>i + 1);;
return_C ret__unsigned_long_'_update i_')) (?d'1458 receivera sendera recvBuf sendBuf na rv')
 3. \<And>receivera sendera recvBuf sendBuf na rv rv'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits; ?r'1458 receivera sendera recvBuf sendBuf na rv rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q1458 receivera sendera recvBuf sendBuf na rv) (?Q'1458 receivera sendera recvBuf sendBuf na rv rv') [SKIP] (do bufferMRs <- case sendBuffer of None \<Rightarrow> return [] | Some sbPtr \<Rightarrow> case recvBuffer of None \<Rightarrow> return [] | Some rbPtr \<Rightarrow> mapM (\<lambda>x. loadWordUser (sbPtr + PPtr (x * 4)) >>= storeWordUser (rbPtr + PPtr (x * 4))) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. n];
return (min n (word_of_nat (min (length TCB_H.msgRegisters) (unat n)) + word_of_nat (length bufferMRs)))
od) (?d'1458 receivera sendera recvBuf sendBuf na rv')
 4. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>?Q1458 receivera sendera recvBuf sendBuf na\<rbrace>
 5. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'1458 receivera sendera recvBuf sendBuf na) (?xf'1458 receivera sendera recvBuf sendBuf na) (?Q'1458 receivera sendera recvBuf sendBuf na)
 6. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P1466 receivera sendera recvBuf sendBuf na and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> ?Q'1443 receivera sendera recvBuf sendBuf na proof (prove)
goal (9 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf na nb. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> (nb < n \<and> nb < SCAST(32 signed \<rightarrow> 32) n_msgRegisters) = (nb < word_of_nat (length (take (unat n) TCB_H.msgRegisters)))
 2. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 3. \<And>receivera sendera recvBuf sendBuf na nb. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits; Suc nb < length (take (unat n) TCB_H.msgRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> do v <- asUser sender (getRegister (take (unat n) TCB_H.msgRegisters ! nb));
asUser receiver (setRegister (take (unat n) TCB_H.msgRegisters ! nb) v)
od \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits
 5. \<And>receivera sendera recvBuf sendBuf na rv' t t'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF PTR(32 word) (option_to_0 recvBuffer) = NULL \<or> PTR(32 word) (option_to_0 sendBuffer) = NULL THEN
  return_C ret__unsigned_long_'_update i_'
FI;;
(While \<lbrace>\<acute>i < n\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 sendBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 sendBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 sendBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (option_to_0 sendBuffer) +\<^sub>p uint (\<acute>i + 1)))))))))));;
\<acute>i :== \<acute>i + 1);;
return_C ret__unsigned_long_'_update i_')) (?d'1458 receivera sendera recvBuf sendBuf na rv')
 6. \<And>receivera sendera recvBuf sendBuf na rv rv'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits; rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q1458 receivera sendera recvBuf sendBuf na rv) (?Q'1458 receivera sendera recvBuf sendBuf na rv rv') [SKIP] (do bufferMRs <- case sendBuffer of None \<Rightarrow> return [] | Some sbPtr \<Rightarrow> case recvBuffer of None \<Rightarrow> return [] | Some rbPtr \<Rightarrow> mapM (\<lambda>x. loadWordUser (sbPtr + PPtr (x * 4)) >>= storeWordUser (rbPtr + PPtr (x * 4))) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. n];
return (min n (word_of_nat (min (length TCB_H.msgRegisters) (unat n)) + word_of_nat (length bufferMRs)))
od) (?d'1458 receivera sendera recvBuf sendBuf na rv')
 7. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>?Q1458 receivera sendera recvBuf sendBuf na\<rbrace>
 8. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (?Q'1458 receivera sendera recvBuf sendBuf na)
 9. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV proof (prove)
goal (9 subgoals):
 1. \<And>na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; n = n && mask msgLengthBits; (if 4 \<le> unat n then 4 else unat n) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> (4 \<le> unat n \<longrightarrow> (na < n \<and> na < 4) = (na < 4)) \<and> (\<not> 4 \<le> unat n \<longrightarrow> (na < n \<and> na < 4) = (na < n))
 2. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 3. \<And>receivera sendera recvBuf sendBuf na nb. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits; Suc nb < length (take (unat n) TCB_H.msgRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> do v <- asUser sender (getRegister (take (unat n) TCB_H.msgRegisters ! nb));
asUser receiver (setRegister (take (unat n) TCB_H.msgRegisters ! nb) v)
od \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits
 5. \<And>receivera sendera recvBuf sendBuf na rv' t t'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF PTR(32 word) (option_to_0 recvBuffer) = NULL \<or> PTR(32 word) (option_to_0 sendBuffer) = NULL THEN
  return_C ret__unsigned_long_'_update i_'
FI;;
(While \<lbrace>\<acute>i < n\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 sendBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 sendBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 sendBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (option_to_0 sendBuffer) +\<^sub>p uint (\<acute>i + 1)))))))))));;
\<acute>i :== \<acute>i + 1);;
return_C ret__unsigned_long_'_update i_')) (?d'1458 receivera sendera recvBuf sendBuf na rv')
 6. \<And>receivera sendera recvBuf sendBuf na rv rv'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits; rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q1458 receivera sendera recvBuf sendBuf na rv) (?Q'1458 receivera sendera recvBuf sendBuf na rv rv') [SKIP] (do bufferMRs <- case sendBuffer of None \<Rightarrow> return [] | Some sbPtr \<Rightarrow> case recvBuffer of None \<Rightarrow> return [] | Some rbPtr \<Rightarrow> mapM (\<lambda>x. loadWordUser (sbPtr + PPtr (x * 4)) >>= storeWordUser (rbPtr + PPtr (x * 4))) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. n];
return (min n (word_of_nat (min (length TCB_H.msgRegisters) (unat n)) + word_of_nat (length bufferMRs)))
od) (?d'1458 receivera sendera recvBuf sendBuf na rv')
 7. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>?Q1458 receivera sendera recvBuf sendBuf na\<rbrace>
 8. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (?Q'1458 receivera sendera recvBuf sendBuf na)
 9. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV proof (prove)
goal (8 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (\<acute>ret__unsigned_long :== CALL getRegister_'proc(tcb_ptr_to_ctcb_ptr sender,kernel_all_global_addresses.msgRegisters.[unat \<acute>i]));;
Guard ArrayBounds \<lbrace>\<acute>i < 4\<rbrace> (CALL setRegister_'proc(tcb_ptr_to_ctcb_ptr receiver,kernel_all_global_addresses.msgRegisters.[unat \<acute>i],\<acute>ret__unsigned_long)) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 2. \<And>receivera sendera recvBuf sendBuf na nb. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits; Suc nb < length (take (unat n) TCB_H.msgRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> do v <- asUser sender (getRegister (take (unat n) TCB_H.msgRegisters ! nb));
asUser receiver (setRegister (take (unat n) TCB_H.msgRegisters ! nb) v)
od \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits
 4. \<And>receivera sendera recvBuf sendBuf na rv' t t'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF PTR(32 word) (option_to_0 recvBuffer) = NULL \<or> PTR(32 word) (option_to_0 sendBuffer) = NULL THEN
  return_C ret__unsigned_long_'_update i_'
FI;;
(While \<lbrace>\<acute>i < n\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 sendBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 sendBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 sendBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (option_to_0 sendBuffer) +\<^sub>p uint (\<acute>i + 1)))))))))));;
\<acute>i :== \<acute>i + 1);;
return_C ret__unsigned_long_'_update i_')) (?d'1458 receivera sendera recvBuf sendBuf na rv')
 5. \<And>receivera sendera recvBuf sendBuf na rv rv'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits; rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q1458 receivera sendera recvBuf sendBuf na rv) (?Q'1458 receivera sendera recvBuf sendBuf na rv rv') [SKIP] (do bufferMRs <- case sendBuffer of None \<Rightarrow> return [] | Some sbPtr \<Rightarrow> case recvBuffer of None \<Rightarrow> return [] | Some rbPtr \<Rightarrow> mapM (\<lambda>x. loadWordUser (sbPtr + PPtr (x * 4)) >>= storeWordUser (rbPtr + PPtr (x * 4))) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. n];
return (min n (word_of_nat (min (length TCB_H.msgRegisters) (unat n)) + word_of_nat (length bufferMRs)))
od) (?d'1458 receivera sendera recvBuf sendBuf na rv')
 6. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>?Q1458 receivera sendera recvBuf sendBuf na\<rbrace>
 7. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (?Q'1458 receivera sendera recvBuf sendBuf na)
 8. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV proof (prove)
goal (8 subgoals):
 1. \<And>t_hrs i. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits; n = n && mask msgLengthBits\<rbrakk> \<Longrightarrow> i < 4 \<longrightarrow> kernel_all_global_addresses.msgRegisters.[unat i] < SCAST(32 signed \<rightarrow> 32) 0x14 \<longrightarrow> hrs_htd t_hrs \<Turnstile>\<^sub>t tcb_ptr_to_ctcb_ptr sender \<longrightarrow> hrs_htd t_hrs \<Turnstile>\<^sub>t tcb_ptr_to_ctcb_ptr receiver \<longrightarrow> i = i
 2. \<And>receivera sendera recvBuf sendBuf na nb. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits; Suc nb < length (take (unat n) TCB_H.msgRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> do v <- asUser sender (getRegister (take (unat n) TCB_H.msgRegisters ! nb));
asUser receiver (setRegister (take (unat n) TCB_H.msgRegisters ! nb) v)
od \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits
 4. \<And>receivera sendera recvBuf sendBuf na rv' t t'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF PTR(32 word) (option_to_0 recvBuffer) = NULL \<or> PTR(32 word) (option_to_0 sendBuffer) = NULL THEN
  return_C ret__unsigned_long_'_update i_'
FI;;
(While \<lbrace>\<acute>i < n\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 sendBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 sendBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 sendBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (option_to_0 sendBuffer) +\<^sub>p uint (\<acute>i + 1)))))))))));;
\<acute>i :== \<acute>i + 1);;
return_C ret__unsigned_long_'_update i_')) (?d'1458 receivera sendera recvBuf sendBuf na rv')
 5. \<And>receivera sendera recvBuf sendBuf na rv rv'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits; rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q1458 receivera sendera recvBuf sendBuf na rv) (?Q'1458 receivera sendera recvBuf sendBuf na rv rv') [SKIP] (do bufferMRs <- case sendBuffer of None \<Rightarrow> return [] | Some sbPtr \<Rightarrow> case recvBuffer of None \<Rightarrow> return [] | Some rbPtr \<Rightarrow> mapM (\<lambda>x. loadWordUser (sbPtr + PPtr (x * 4)) >>= storeWordUser (rbPtr + PPtr (x * 4))) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. n];
return (min n (word_of_nat (min (length TCB_H.msgRegisters) (unat n)) + word_of_nat (length bufferMRs)))
od) (?d'1458 receivera sendera recvBuf sendBuf na rv')
 6. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>?Q1458 receivera sendera recvBuf sendBuf na\<rbrace>
 7. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (?Q'1458 receivera sendera recvBuf sendBuf na)
 8. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV proof (prove)
goal (7 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf na nb. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits; Suc nb < length (take (unat n) TCB_H.msgRegisters)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>_. True\<rbrace> do v <- asUser sender (getRegister (take (unat n) TCB_H.msgRegisters ! nb));
asUser receiver (setRegister (take (unat n) TCB_H.msgRegisters ! nb) v)
od \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits
 3. \<And>receivera sendera recvBuf sendBuf na rv' t t'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF PTR(32 word) (option_to_0 recvBuffer) = NULL \<or> PTR(32 word) (option_to_0 sendBuffer) = NULL THEN
  return_C ret__unsigned_long_'_update i_'
FI;;
(While \<lbrace>\<acute>i < n\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 sendBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 sendBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 sendBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (option_to_0 sendBuffer) +\<^sub>p uint (\<acute>i + 1)))))))))));;
\<acute>i :== \<acute>i + 1);;
return_C ret__unsigned_long_'_update i_')) (?d'1458 receivera sendera recvBuf sendBuf na rv')
 4. \<And>receivera sendera recvBuf sendBuf na rv rv'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits; rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q1458 receivera sendera recvBuf sendBuf na rv) (?Q'1458 receivera sendera recvBuf sendBuf na rv rv') [SKIP] (do bufferMRs <- case sendBuffer of None \<Rightarrow> return [] | Some sbPtr \<Rightarrow> case recvBuffer of None \<Rightarrow> return [] | Some rbPtr \<Rightarrow> mapM (\<lambda>x. loadWordUser (sbPtr + PPtr (x * 4)) >>= storeWordUser (rbPtr + PPtr (x * 4))) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. n];
return (min n (word_of_nat (min (length TCB_H.msgRegisters) (unat n)) + word_of_nat (length bufferMRs)))
od) (?d'1458 receivera sendera recvBuf sendBuf na rv')
 5. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>?Q1458 receivera sendera recvBuf sendBuf na\<rbrace>
 6. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (?Q'1458 receivera sendera recvBuf sendBuf na)
 7. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV proof (prove)
goal (6 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits
 2. \<And>receivera sendera recvBuf sendBuf na rv' t t'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF PTR(32 word) (option_to_0 recvBuffer) = NULL \<or> PTR(32 word) (option_to_0 sendBuffer) = NULL THEN
  return_C ret__unsigned_long_'_update i_'
FI;;
(While \<lbrace>\<acute>i < n\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 sendBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 sendBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 sendBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (option_to_0 sendBuffer) +\<^sub>p uint (\<acute>i + 1)))))))))));;
\<acute>i :== \<acute>i + 1);;
return_C ret__unsigned_long_'_update i_')) (?d'1458 receivera sendera recvBuf sendBuf na rv')
 3. \<And>receivera sendera recvBuf sendBuf na rv rv'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits; rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q1458 receivera sendera recvBuf sendBuf na rv) (?Q'1458 receivera sendera recvBuf sendBuf na rv rv') [SKIP] (do bufferMRs <- case sendBuffer of None \<Rightarrow> return [] | Some sbPtr \<Rightarrow> case recvBuffer of None \<Rightarrow> return [] | Some rbPtr \<Rightarrow> mapM (\<lambda>x. loadWordUser (sbPtr + PPtr (x * 4)) >>= storeWordUser (rbPtr + PPtr (x * 4))) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. n];
return (min n (word_of_nat (min (length TCB_H.msgRegisters) (unat n)) + word_of_nat (length bufferMRs)))
od) (?d'1458 receivera sendera recvBuf sendBuf na rv')
 4. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>?Q1458 receivera sendera recvBuf sendBuf na\<rbrace>
 5. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (?Q'1458 receivera sendera recvBuf sendBuf na)
 6. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV proof (prove)
goal (5 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf na rv' t t'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (IF PTR(32 word) (option_to_0 recvBuffer) = NULL \<or> PTR(32 word) (option_to_0 sendBuffer) = NULL THEN
  return_C ret__unsigned_long_'_update i_'
FI;;
(While \<lbrace>\<acute>i < n\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 sendBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 sendBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 sendBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (option_to_0 sendBuffer) +\<^sub>p uint (\<acute>i + 1)))))))))));;
\<acute>i :== \<acute>i + 1);;
return_C ret__unsigned_long_'_update i_')) (?d'1458 receivera sendera recvBuf sendBuf na rv')
 2. \<And>receivera sendera recvBuf sendBuf na rv rv'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits; rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q1458 receivera sendera recvBuf sendBuf na rv) (?Q'1458 receivera sendera recvBuf sendBuf na rv rv') [SKIP] (do bufferMRs <- case sendBuffer of None \<Rightarrow> return [] | Some sbPtr \<Rightarrow> case recvBuffer of None \<Rightarrow> return [] | Some rbPtr \<Rightarrow> mapM (\<lambda>x. loadWordUser (sbPtr + PPtr (x * 4)) >>= storeWordUser (rbPtr + PPtr (x * 4))) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. n];
return (min n (word_of_nat (min (length TCB_H.msgRegisters) (unat n)) + word_of_nat (length bufferMRs)))
od) (?d'1458 receivera sendera recvBuf sendBuf na rv')
 3. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>?Q1458 receivera sendera recvBuf sendBuf na\<rbrace>
 4. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (?Q'1458 receivera sendera recvBuf sendBuf na)
 5. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf na rv rv'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits; rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q1458 receivera sendera recvBuf sendBuf na rv) (?Q'1458 receivera sendera recvBuf sendBuf na rv rv') [SKIP] (do bufferMRs <- case sendBuffer of None \<Rightarrow> return [] | Some sbPtr \<Rightarrow> case recvBuffer of None \<Rightarrow> return [] | Some rbPtr \<Rightarrow> mapM (\<lambda>x. loadWordUser (sbPtr + PPtr (x * 4)) >>= storeWordUser (rbPtr + PPtr (x * 4))) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. n];
return (min n (word_of_nat (min (length TCB_H.msgRegisters) (unat n)) + word_of_nat (length bufferMRs)))
od) (IF PTR(32 word) (option_to_0 recvBuffer) = NULL \<or> PTR(32 word) (option_to_0 sendBuffer) = NULL THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(While \<lbrace>\<acute>i < n\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 sendBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 sendBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 sendBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (option_to_0 sendBuffer) +\<^sub>p uint (\<acute>i + 1)))))))))));;
\<acute>i :== \<acute>i + 1);;
return_C ret__unsigned_long_'_update i_'))
 2. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>?Q1458 receivera sendera recvBuf sendBuf na\<rbrace>
 3. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (?Q'1458 receivera sendera recvBuf sendBuf na)
 4. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV proof (prove)
goal (5 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf rv'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (case recvBuffer of None \<Rightarrow> 0 | Some y \<Rightarrow> y); sendBuf = NULL; n = n && mask msgLengthBits; min (length TCB_H.msgRegisters) (unat n) < 2 ^ word_bits; rv' = word_of_nat (min (length TCB_H.msgRegisters) (unat n)); sendBuffer = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R1950 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (case recvBuffer of None \<Rightarrow> 0 | Some y \<Rightarrow> y)) NULL n ()) (?R''1952 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (case recvBuffer of None \<Rightarrow> 0 | Some y \<Rightarrow> y)) NULL n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n)))) [SKIP] (return (min n (word_of_nat (min (length TCB_H.msgRegisters) (unat n))))) (return_C ret__unsigned_long_'_update (\<lambda>s. word_of_nat (min (length TCB_H.msgRegisters) (unat n)));;
(While \<lbrace>\<acute>i < n\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (case recvBuffer of None \<Rightarrow> 0 | Some y \<Rightarrow> y)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) ((case recvBuffer of None \<Rightarrow> 0 | Some y \<Rightarrow> y) + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion NULL (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (i_' s * 4 + 4)} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (case recvBuffer of None \<Rightarrow> 0 | Some y \<Rightarrow> y)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion NULL (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) ((case recvBuffer of None \<Rightarrow> 0 | Some y \<Rightarrow> y) + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (\<acute>i * 4 + 4)))))))))));;
\<acute>i :== \<acute>i + 1);;
return_C ret__unsigned_long_'_update i_'))
 2. \<And>receivera sendera recvBuf sendBuf na rv rv' x2. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits; rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters)); sendBuffer = Some x2\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R1951 receivera sendera recvBuf sendBuf na rv x2) (?R''1953 receivera sendera recvBuf sendBuf na rv rv' x2) [SKIP] (do bufferMRs <- case recvBuffer of None \<Rightarrow> return [] | Some rbPtr \<Rightarrow> mapM (\<lambda>x. loadWordUser (x2 + PPtr (x * 4)) >>= storeWordUser (rbPtr + PPtr (x * 4))) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. n];
return (min n (word_of_nat (min (length TCB_H.msgRegisters) (unat n)) + word_of_nat (length bufferMRs)))
od) (IF PTR(32 word) (option_to_0 recvBuffer) = NULL \<or> PTR(32 word) (option_to_0 sendBuffer) = NULL THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(While \<lbrace>\<acute>i < n\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 sendBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 sendBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 sendBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (option_to_0 sendBuffer) +\<^sub>p uint (\<acute>i + 1)))))))))));;
\<acute>i :== \<acute>i + 1);;
return_C ret__unsigned_long_'_update i_'))
 3. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. (sendBuffer = None \<longrightarrow> ?R1950 receivera sendera recvBuf sendBuf na rv s) \<and> (\<forall>x. sendBuffer = Some x \<longrightarrow> ?R1951 receivera sendera recvBuf sendBuf na rv x s)\<rbrace>
 4. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (\<lambda>rv rv'. {s. sendBuffer = None \<longrightarrow> s \<in> ?R''1952 receivera sendera recvBuf sendBuf na rv rv'} \<inter> {s. \<forall>x. s \<in> {s. sendBuffer = Some x \<longrightarrow> s \<in> ?R''1953 receivera sendera recvBuf sendBuf na rv rv' x}})
 5. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV proof (prove)
goal (5 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf rv'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (case recvBuffer of None \<Rightarrow> 0 | Some y \<Rightarrow> y); sendBuf = NULL; n = n && mask msgLengthBits; min (length TCB_H.msgRegisters) (unat n) < 2 ^ word_bits; rv' = word_of_nat (min (length TCB_H.msgRegisters) (unat n)); sendBuffer = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1980 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (case recvBuffer of None \<Rightarrow> 0 | Some y \<Rightarrow> y)) NULL n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n)))) return_C ret__unsigned_long_'_update (\<lambda>s. word_of_nat (min (length TCB_H.msgRegisters) (unat n))) {},UNIV
 2. \<And>receivera sendera recvBuf sendBuf na rv rv' x2. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits; rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters)); sendBuffer = Some x2\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R1951 receivera sendera recvBuf sendBuf na rv x2) (?R''1953 receivera sendera recvBuf sendBuf na rv rv' x2) [SKIP] (do bufferMRs <- case recvBuffer of None \<Rightarrow> return [] | Some rbPtr \<Rightarrow> mapM (\<lambda>x. loadWordUser (x2 + PPtr (x * 4)) >>= storeWordUser (rbPtr + PPtr (x * 4))) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. n];
return (min n (word_of_nat (min (length TCB_H.msgRegisters) (unat n)) + word_of_nat (length bufferMRs)))
od) (IF PTR(32 word) (option_to_0 recvBuffer) = NULL \<or> PTR(32 word) (option_to_0 sendBuffer) = NULL THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(While \<lbrace>\<acute>i < n\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 sendBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 sendBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 sendBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (option_to_0 sendBuffer) +\<^sub>p uint (\<acute>i + 1)))))))))));;
\<acute>i :== \<acute>i + 1);;
return_C ret__unsigned_long_'_update i_'))
 3. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. (sendBuffer = None \<longrightarrow> True) \<and> (\<forall>x. sendBuffer = Some x \<longrightarrow> ?R1951 receivera sendera recvBuf sendBuf na rv x s)\<rbrace>
 4. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (\<lambda>rv rv'. {s. sendBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> ?R'1980 receivera sendera recvBuf sendBuf na rv rv'} \<inter> {s. \<forall>x. s \<in> {s. sendBuffer = Some x \<longrightarrow> s \<in> ?R''1953 receivera sendera recvBuf sendBuf na rv rv' x}})
 5. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf na rv rv' x2. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits; rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters)); sendBuffer = Some x2\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R1951 receivera sendera recvBuf sendBuf na rv x2) (?R''1953 receivera sendera recvBuf sendBuf na rv rv' x2) [SKIP] (do bufferMRs <- case recvBuffer of None \<Rightarrow> return [] | Some rbPtr \<Rightarrow> mapM (\<lambda>x. loadWordUser (x2 + PPtr (x * 4)) >>= storeWordUser (rbPtr + PPtr (x * 4))) [fromIntegral $ length TCB_H.msgRegisters + 1 .e. n];
return (min n (word_of_nat (min (length TCB_H.msgRegisters) (unat n)) + word_of_nat (length bufferMRs)))
od) (IF PTR(32 word) (option_to_0 recvBuffer) = NULL \<or> PTR(32 word) (option_to_0 sendBuffer) = NULL THEN
  return_C ret__unsigned_long_'_update (\<lambda>s. rv')
FI;;
(While \<lbrace>\<acute>i < n\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 sendBuffer)) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (PTR(32 word) (option_to_0 sendBuffer) +\<^sub>p uint (i_' s + 1))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 recvBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) (option_to_0 sendBuffer)) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (option_to_0 recvBuffer) +\<^sub>p uint (\<acute>i + 1)) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (option_to_0 sendBuffer) +\<^sub>p uint (\<acute>i + 1)))))))))));;
\<acute>i :== \<acute>i + 1);;
return_C ret__unsigned_long_'_update i_'))
 2. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. (sendBuffer = None \<longrightarrow> True) \<and> (\<forall>x. sendBuffer = Some x \<longrightarrow> ?R1951 receivera sendera recvBuf sendBuf na rv x s)\<rbrace>
 3. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (\<lambda>rv rv'. {s. sendBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. sendBuffer = Some x \<longrightarrow> s \<in> ?R''1953 receivera sendera recvBuf sendBuf na rv rv' x}})
 4. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV proof (prove)
goal (5 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf rv' x2. \<lbrakk>unat n \<le> msgMaxLength; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = NULL; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; min (length TCB_H.msgRegisters) (unat n) < 2 ^ word_bits; rv' = word_of_nat (min (length TCB_H.msgRegisters) (unat n)); sendBuffer = Some x2; recvBuffer = None\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R2005 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) NULL (PTR(32 word) x2) n () x2) (?R''2007 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) NULL (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2) [SKIP] (return (min n (word_of_nat (min (length TCB_H.msgRegisters) (unat n))))) (return_C ret__unsigned_long_'_update (\<lambda>s. word_of_nat (min (length TCB_H.msgRegisters) (unat n)));;
(While \<lbrace>\<acute>i < n\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion NULL (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (i_' s * 4 + 4)} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion NULL (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (\<acute>i * 4 + 4)) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))))))))))));;
\<acute>i :== \<acute>i + 1);;
return_C ret__unsigned_long_'_update i_'))
 2. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; min (length TCB_H.msgRegisters) (unat n) < 2 ^ word_bits; rv' = word_of_nat (min (length TCB_H.msgRegisters) (unat n)); sendBuffer = Some x2; recvBuffer = Some x2a\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R2006 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a) (?R''2008 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2 x2a) [SKIP] (do bufferMRs <- mapM (\<lambda>x. loadWordUser (x2 + x * 4) >>= storeWordUser (x2a + x * 4)) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n];
return (min n (word_of_nat (min (length TCB_H.msgRegisters) (unat n)) + word_of_nat (length bufferMRs)))
od) (While \<lbrace>\<acute>i < n\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))))))))))));;
\<acute>i :== \<acute>i + 1);;
return_C ret__unsigned_long_'_update i_')
 3. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. (sendBuffer = None \<longrightarrow> True) \<and> (\<forall>x. sendBuffer = Some x \<longrightarrow> (recvBuffer = None \<longrightarrow> ?R2005 receivera sendera recvBuf sendBuf na rv x s) \<and> (\<forall>xa. recvBuffer = Some xa \<longrightarrow> ?R2006 receivera sendera recvBuf sendBuf na rv x xa s))\<rbrace>
 4. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (\<lambda>rv rv'. {s. sendBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. sendBuffer = Some x \<longrightarrow> s \<in> {s. recvBuffer = None \<longrightarrow> s \<in> ?R''2007 receivera sendera recvBuf sendBuf na rv rv' x} \<inter> {s. \<forall>xa. s \<in> {s. recvBuffer = Some xa \<longrightarrow> s \<in> ?R''2008 receivera sendera recvBuf sendBuf na rv rv' x xa}}}})
 5. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV proof (prove)
goal (5 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf rv' x2. \<lbrakk>unat n \<le> msgMaxLength; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = NULL; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; min (length TCB_H.msgRegisters) (unat n) < 2 ^ word_bits; rv' = word_of_nat (min (length TCB_H.msgRegisters) (unat n)); sendBuffer = Some x2; recvBuffer = None\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2037 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) NULL (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2) return_C ret__unsigned_long_'_update (\<lambda>s. word_of_nat (min (length TCB_H.msgRegisters) (unat n))) {},UNIV
 2. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; min (length TCB_H.msgRegisters) (unat n) < 2 ^ word_bits; rv' = word_of_nat (min (length TCB_H.msgRegisters) (unat n)); sendBuffer = Some x2; recvBuffer = Some x2a\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R2006 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a) (?R''2008 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2 x2a) [SKIP] (do bufferMRs <- mapM (\<lambda>x. loadWordUser (x2 + x * 4) >>= storeWordUser (x2a + x * 4)) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n];
return (min n (word_of_nat (min (length TCB_H.msgRegisters) (unat n)) + word_of_nat (length bufferMRs)))
od) (While \<lbrace>\<acute>i < n\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))))))))))));;
\<acute>i :== \<acute>i + 1);;
return_C ret__unsigned_long_'_update i_')
 3. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. (sendBuffer = None \<longrightarrow> True) \<and> (\<forall>x. sendBuffer = Some x \<longrightarrow> (recvBuffer = None \<longrightarrow> True) \<and> (\<forall>xa. recvBuffer = Some xa \<longrightarrow> ?R2006 receivera sendera recvBuf sendBuf na rv x xa s))\<rbrace>
 4. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (\<lambda>rv rv'. {s. sendBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. sendBuffer = Some x \<longrightarrow> s \<in> {s. recvBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> ?R'2037 receivera sendera recvBuf sendBuf na rv rv' x} \<inter> {s. \<forall>xa. s \<in> {s. recvBuffer = Some xa \<longrightarrow> s \<in> ?R''2008 receivera sendera recvBuf sendBuf na rv rv' x xa}}}})
 5. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; min (length TCB_H.msgRegisters) (unat n) < 2 ^ word_bits; rv' = word_of_nat (min (length TCB_H.msgRegisters) (unat n)); sendBuffer = Some x2; recvBuffer = Some x2a\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R2006 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a) (?R''2008 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2 x2a) [SKIP] (do bufferMRs <- mapM (\<lambda>x. loadWordUser (x2 + x * 4) >>= storeWordUser (x2a + x * 4)) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n];
return (min n (word_of_nat (min (length TCB_H.msgRegisters) (unat n)) + word_of_nat (length bufferMRs)))
od) (While \<lbrace>\<acute>i < n\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))))))))))));;
\<acute>i :== \<acute>i + 1);;
return_C ret__unsigned_long_'_update i_')
 2. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. (sendBuffer = None \<longrightarrow> True) \<and> (\<forall>x. sendBuffer = Some x \<longrightarrow> (recvBuffer = None \<longrightarrow> True) \<and> (\<forall>xa. recvBuffer = Some xa \<longrightarrow> ?R2006 receivera sendera recvBuf sendBuf na rv x xa s))\<rbrace>
 3. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (\<lambda>rv rv'. {s. sendBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. sendBuffer = Some x \<longrightarrow> s \<in> {s. recvBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. recvBuffer = Some xa \<longrightarrow> s \<in> ?R''2008 receivera sendera recvBuf sendBuf na rv rv' x xa}}}})
 4. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; min (length TCB_H.msgRegisters) (unat n) < 2 ^ word_bits; rv' = word_of_nat (min (length TCB_H.msgRegisters) (unat n)); sendBuffer = Some x2; recvBuffer = Some x2a\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?R2055 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a) (?R''2056 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2 x2a) [SKIP] (do _ <- mapM_x (\<lambda>a. loadWordUser (x2 + a * 4) >>= storeWordUser (x2a + a * 4)) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n];
return (min n (word_of_nat (min (length TCB_H.msgRegisters) (unat n)) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])))
od) (While \<lbrace>\<acute>i < n\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))))))))))));;
\<acute>i :== \<acute>i + 1);;
return_C ret__unsigned_long_'_update i_')
 2. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. (sendBuffer = None \<longrightarrow> True) \<and> (\<forall>x. sendBuffer = Some x \<longrightarrow> (recvBuffer = None \<longrightarrow> True) \<and> (\<forall>xa. recvBuffer = Some xa \<longrightarrow> ?R2006 receivera sendera recvBuf sendBuf na rv x xa s))\<rbrace>
 3. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (\<lambda>rv rv'. {s. sendBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. sendBuffer = Some x \<longrightarrow> s \<in> {s. recvBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. recvBuffer = Some xa \<longrightarrow> s \<in> ?R''2008 receivera sendera recvBuf sendBuf na rv rv' x xa}}}})
 4. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>x2 x2a. ?R''2056 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?R''2008 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2 x2a
\<lambda>x2 x2a. ?R2055 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?R2006 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a proof (prove)
goal (5 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; min (length TCB_H.msgRegisters) (unat n) < 2 ^ word_bits; rv' = word_of_nat (min (length TCB_H.msgRegisters) (unat n)); sendBuffer = Some x2; recvBuffer = Some x2a; unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?G2064 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a) (?G'2069 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2 x2a) [SKIP] (do _ <- mapM_x (\<lambda>a. loadWordUser (x2 + a * 4) >>= storeWordUser (x2a + a * 4)) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n];
return (min n (word_of_nat (min (length TCB_H.msgRegisters) (unat n)) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])))
od) (While \<lbrace>\<acute>i < n\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))))))))))));;
\<acute>i :== \<acute>i + 1);;
return_C ret__unsigned_long_'_update i_')
 2. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; min (length TCB_H.msgRegisters) (unat n) < 2 ^ word_bits; rv' = word_of_nat (min (length TCB_H.msgRegisters) (unat n)); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?H2063 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a) (?H'2067 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2 x2a) [SKIP] (do _ <- mapM_x (\<lambda>a. loadWordUser (x2 + a * 4) >>= storeWordUser (x2a + a * 4)) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n];
return (min n (word_of_nat (min (length TCB_H.msgRegisters) (unat n)) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])))
od) (While \<lbrace>\<acute>i < n\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))))))))))));;
\<acute>i :== \<acute>i + 1);;
return_C ret__unsigned_long_'_update i_')
 3. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. (sendBuffer = None \<longrightarrow> True) \<and> (\<forall>x. sendBuffer = Some x \<longrightarrow> (recvBuffer = None \<longrightarrow> True) \<and> (\<forall>xa. recvBuffer = Some xa \<longrightarrow> (unat na \<le> length TCB_H.msgRegisters \<longrightarrow> ?G2066 receivera sendera recvBuf sendBuf na rv x xa s) \<and> (\<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> ?H2065 receivera sendera recvBuf sendBuf na rv x xa s)))\<rbrace>
 4. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (\<lambda>rv rv'. {s. sendBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. sendBuffer = Some x \<longrightarrow> s \<in> {s. recvBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. recvBuffer = Some xa \<longrightarrow> s \<in> {s. unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> ?G'2072 receivera sendera recvBuf sendBuf na rv rv' x xa} \<inter> {s. \<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> ?H'2071 receivera sendera recvBuf sendBuf na rv rv' x xa}}}}})
 5. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>x2 x2a. ?G2066 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?G2064 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a
\<lambda>x2 x2a. ?H2065 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?H2063 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a
\<lambda>x2 x2a. ?G'2069 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?G'2072 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2 x2a
\<lambda>x2 x2a. ?H'2067 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?H'2071 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2 x2a proof (prove)
goal (5 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; unat n < 2 ^ word_bits; rv' = n; sendBuffer = Some x2; recvBuffer = Some x2a; unat n \<le> 4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?G2064 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a) (?G'2069 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () n x2 x2a) [SKIP] (return n) (While \<lbrace>\<acute>i < n\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))))))))))));;
\<acute>i :== \<acute>i + 1);;
return_C ret__unsigned_long_'_update i_')
 2. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; min (length TCB_H.msgRegisters) (unat n) < 2 ^ word_bits; rv' = word_of_nat (min (length TCB_H.msgRegisters) (unat n)); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?H2063 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a) (?H'2067 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2 x2a) [SKIP] (do _ <- mapM_x (\<lambda>a. loadWordUser (x2 + a * 4) >>= storeWordUser (x2a + a * 4)) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n];
return (min n (word_of_nat (min (length TCB_H.msgRegisters) (unat n)) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])))
od) (While \<lbrace>\<acute>i < n\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))))))))))));;
\<acute>i :== \<acute>i + 1);;
return_C ret__unsigned_long_'_update i_')
 3. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. (sendBuffer = None \<longrightarrow> True) \<and> (\<forall>x. sendBuffer = Some x \<longrightarrow> (recvBuffer = None \<longrightarrow> True) \<and> (\<forall>xa. recvBuffer = Some xa \<longrightarrow> (unat na \<le> length TCB_H.msgRegisters \<longrightarrow> ?G2066 receivera sendera recvBuf sendBuf na rv x xa s) \<and> (\<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> ?H2065 receivera sendera recvBuf sendBuf na rv x xa s)))\<rbrace>
 4. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (\<lambda>rv rv'. {s. sendBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. sendBuffer = Some x \<longrightarrow> s \<in> {s. recvBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. recvBuffer = Some xa \<longrightarrow> s \<in> {s. unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> ?G'2072 receivera sendera recvBuf sendBuf na rv rv' x xa} \<inter> {s. \<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> ?H'2071 receivera sendera recvBuf sendBuf na rv rv' x xa}}}}})
 5. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>x2 x2a. ?G2066 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?G2064 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a
\<lambda>x2 x2a. ?H2065 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?H2063 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a
\<lambda>x2 x2a. ?G'2069 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?G'2072 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2 x2a
\<lambda>x2 x2a. ?H'2067 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?H'2071 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2 x2a proof (prove)
goal (5 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; unat n < 2 ^ word_bits; rv' = n; sendBuffer = Some x2; recvBuffer = Some x2a; unat n \<le> 4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?G2064 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a) (?G'2069 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () n x2 x2a) [SKIP] (return n) (IF \<acute>i < n THEN
  Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))))))))))));;
\<acute>i :== \<acute>i + 1;;
While \<lbrace>\<acute>i < n\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))))))))))));;
\<acute>i :== \<acute>i + 1);;
return_C ret__unsigned_long_'_update i_'
ELSE
  return_C ret__unsigned_long_'_update i_'
FI)
 2. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; min (length TCB_H.msgRegisters) (unat n) < 2 ^ word_bits; rv' = word_of_nat (min (length TCB_H.msgRegisters) (unat n)); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?H2063 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a) (?H'2067 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2 x2a) [SKIP] (do _ <- mapM_x (\<lambda>a. loadWordUser (x2 + a * 4) >>= storeWordUser (x2a + a * 4)) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n];
return (min n (word_of_nat (min (length TCB_H.msgRegisters) (unat n)) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])))
od) (While \<lbrace>\<acute>i < n\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))))))))))));;
\<acute>i :== \<acute>i + 1);;
return_C ret__unsigned_long_'_update i_')
 3. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. (sendBuffer = None \<longrightarrow> True) \<and> (\<forall>x. sendBuffer = Some x \<longrightarrow> (recvBuffer = None \<longrightarrow> True) \<and> (\<forall>xa. recvBuffer = Some xa \<longrightarrow> (unat na \<le> length TCB_H.msgRegisters \<longrightarrow> ?G2066 receivera sendera recvBuf sendBuf na rv x xa s) \<and> (\<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> ?H2065 receivera sendera recvBuf sendBuf na rv x xa s)))\<rbrace>
 4. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (\<lambda>rv rv'. {s. sendBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. sendBuffer = Some x \<longrightarrow> s \<in> {s. recvBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. recvBuffer = Some xa \<longrightarrow> s \<in> {s. unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> ?G'2072 receivera sendera recvBuf sendBuf na rv rv' x xa} \<inter> {s. \<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> ?H'2071 receivera sendera recvBuf sendBuf na rv rv' x xa}}}}})
 5. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>x2 x2a. ?G2066 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?G2064 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a
\<lambda>x2 x2a. ?H2065 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?H2063 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a
\<lambda>x2 x2a. ?G'2072 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?G'2069 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2 x2a
\<lambda>x2 x2a. ?H'2071 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?H'2067 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2 x2a proof (prove)
goal (5 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; unat n < 2 ^ word_bits; rv' = n; sendBuffer = Some x2; recvBuffer = Some x2a; unat n \<le> 4\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?G2064 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a) (?R'2087 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () n x2 x2a) [SKIP] (return n) (return_C ret__unsigned_long_'_update i_')
 2. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; min (length TCB_H.msgRegisters) (unat n) < 2 ^ word_bits; rv' = word_of_nat (min (length TCB_H.msgRegisters) (unat n)); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?H2063 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a) (?H'2067 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2 x2a) [SKIP] (do _ <- mapM_x (\<lambda>a. loadWordUser (x2 + a * 4) >>= storeWordUser (x2a + a * 4)) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n];
return (min n (word_of_nat (min (length TCB_H.msgRegisters) (unat n)) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])))
od) (While \<lbrace>\<acute>i < n\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))))))))))));;
\<acute>i :== \<acute>i + 1);;
return_C ret__unsigned_long_'_update i_')
 3. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. (sendBuffer = None \<longrightarrow> True) \<and> (\<forall>x. sendBuffer = Some x \<longrightarrow> (recvBuffer = None \<longrightarrow> True) \<and> (\<forall>xa. recvBuffer = Some xa \<longrightarrow> (unat na \<le> length TCB_H.msgRegisters \<longrightarrow> ?G2066 receivera sendera recvBuf sendBuf na rv x xa s) \<and> (\<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> ?H2065 receivera sendera recvBuf sendBuf na rv x xa s)))\<rbrace>
 4. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (\<lambda>rv rv'. {s. sendBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. sendBuffer = Some x \<longrightarrow> s \<in> {s. recvBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. recvBuffer = Some xa \<longrightarrow> s \<in> {s. unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> ?R'2088 receivera sendera recvBuf sendBuf na rv rv' x xa \<inter> - \<lbrace>\<acute>i < rv'\<rbrace>} \<inter> {s. \<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> ?H'2071 receivera sendera recvBuf sendBuf na rv rv' x xa}}}}})
 5. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>x2 x2a. ?R'2088 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?R'2087 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2 x2a
\<lambda>x2 x2a. ?G2066 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?G2064 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a
\<lambda>x2 x2a. ?H2065 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?H2063 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a
\<lambda>x2 x2a. ?H'2071 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?H'2067 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2 x2a proof (prove)
goal (4 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?H2063 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a) (?H'2067 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (length TCB_H.msgRegisters)) x2 x2a) [SKIP] (do _ <- mapM_x (\<lambda>a. loadWordUser (x2 + a * 4) >>= storeWordUser (x2a + a * 4)) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n];
return (min n (word_of_nat (length TCB_H.msgRegisters) + word_of_nat (Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))))
od) (While \<lbrace>\<acute>i < n\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))))))))))));;
\<acute>i :== \<acute>i + 1);;
return_C ret__unsigned_long_'_update i_')
 2. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. (sendBuffer = None \<longrightarrow> True) \<and> (\<forall>x. sendBuffer = Some x \<longrightarrow> (recvBuffer = None \<longrightarrow> True) \<and> (\<forall>xa. recvBuffer = Some xa \<longrightarrow> (unat na \<le> length TCB_H.msgRegisters \<longrightarrow> True) \<and> (\<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> ?H2065 receivera sendera recvBuf sendBuf na rv x xa s)))\<rbrace>
 3. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (\<lambda>rv rv'. {s. sendBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. sendBuffer = Some x \<longrightarrow> s \<in> {s. recvBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. recvBuffer = Some xa \<longrightarrow> s \<in> {s. unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> \<lbrace>rv' = \<acute>i && mask msgLengthBits\<rbrace> \<inter> - \<lbrace>\<acute>i < rv'\<rbrace>} \<inter> {s. \<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> ?H'2071 receivera sendera recvBuf sendBuf na rv rv' x xa}}}}})
 4. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>x2 x2a. ?H2065 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?H2063 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a
\<lambda>x2 x2a. ?H'2071 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?H'2067 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2 x2a proof (prove)
goal (8 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> ccorres (?r'2096 receivera sendera recvBuf sendBuf rv' x2 x2a) (?xf'2096 receivera sendera recvBuf sendBuf rv' x2 x2a) (?P2104 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a) (?H'2067 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (length TCB_H.msgRegisters)) x2 x2a) [] (mapM_x (\<lambda>a. loadWordUser (x2 + a * 4) >>= storeWordUser (x2a + a * 4)) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]) (While \<lbrace>\<acute>i < n\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))))))))))));;
\<acute>i :== \<acute>i + 1))
 2. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv'a t t'. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'2096 receivera sendera recvBuf sendBuf rv' x2 x2a) rv'a t t' (return_C ret__unsigned_long_'_update i_') (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 3. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; ?r'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv) (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a) [SKIP] (return (min n (word_of_nat (length TCB_H.msgRegisters) + word_of_nat (Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))))) (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 4. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a\<rbrace> mapM_x (\<lambda>a. loadWordUser (x2 + a * 4) >>= storeWordUser (x2a + a * 4)) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] \<lbrace>?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a\<rbrace>
 5. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'2096 receivera sendera recvBuf sendBuf rv' x2 x2a) (?xf'2096 receivera sendera recvBuf sendBuf rv' x2 x2a) (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a)
 6. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. (sendBuffer = None \<longrightarrow> True) \<and> (\<forall>x. sendBuffer = Some x \<longrightarrow> (recvBuffer = None \<longrightarrow> True) \<and> (\<forall>xa. recvBuffer = Some xa \<longrightarrow> (unat na \<le> length TCB_H.msgRegisters \<longrightarrow> True) \<and> (\<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> (?P2107 receivera sendera recvBuf sendBuf na rv x xa and ?R2106 receivera sendera recvBuf sendBuf na rv x xa) s)))\<rbrace>
 7. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (\<lambda>rv rv'. {s. sendBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. sendBuffer = Some x \<longrightarrow> s \<in> {s. recvBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>xa. s \<in> {s. recvBuffer = Some xa \<longrightarrow> s \<in> {s. unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> \<lbrace>rv' = \<acute>i && mask msgLengthBits\<rbrace> \<inter> - \<lbrace>\<acute>i < rv'\<rbrace>} \<inter> {s. \<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> ?H'2071 receivera sendera recvBuf sendBuf na rv rv' x xa}}}}})
 8. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>x2 x2a. ?P2107 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?P2104 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a
\<lambda>x2 x2a. ?R2106 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a
\<lambda>x2 x2a. ?H'2071 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?H'2067 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () (word_of_nat (min (length TCB_H.msgRegisters) (unat n))) x2 x2a proof (prove)
goal (12 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<forall>na<length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]. ccorres dc xfdc (valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace') \<lbrace>\<acute>i = word_of_nat (length TCB_H.msgRegisters) + word_of_nat na\<rbrace> [] (loadWordUser (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) >>= storeWordUser (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4)) (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))))))))))))
 2. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a na. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> (na < n) = (na < word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]))
 3. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))))))))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a na. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; Suc na < length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]\<rbrakk> \<Longrightarrow> \<lbrace>valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace> loadWordUser (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) >>= storeWordUser (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) \<lbrace>\<lambda>_. valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace>
 5. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> length TCB_H.msgRegisters + length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] < 2 ^ word_bits
 6. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv'a t t'. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (return_C ret__unsigned_long_'_update i_') (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 7. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; rv'a = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv) (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a) [SKIP] (return (min n (word_of_nat (length TCB_H.msgRegisters) + word_of_nat (Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))))) (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 8. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a\<rbrace> mapM_x (\<lambda>a. loadWordUser (x2 + a * 4) >>= storeWordUser (x2a + a * 4)) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] \<lbrace>?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a\<rbrace>
 9. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])) i_' (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a)
 10. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. (sendBuffer = None \<longrightarrow> True) \<and> (\<forall>x. sendBuffer = Some x \<longrightarrow> (recvBuffer = None \<longrightarrow> True) \<and> (\<forall>xa. recvBuffer = Some xa \<longrightarrow> (unat na \<le> length TCB_H.msgRegisters \<longrightarrow> True) \<and> (\<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> (valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace' and ?R2106 receivera sendera recvBuf sendBuf na rv x xa) s)))\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>x2 x2a. ?R2106 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a proof (prove)
goal (12 subgoals):
 1. \<And>x2 x2a na. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; na < Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (valid_ipc_buffer_ptr' x2 and valid_ipc_buffer_ptr' x2a and valid_pspace') \<lbrace>\<acute>i = word_of_nat (length TCB_H.msgRegisters) + word_of_nat na\<rbrace> [] (loadWordUser (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) >>= storeWordUser (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4)) (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))))))))))))
 2. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a na. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> (na < n) = (na < word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]))
 3. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))))))))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a na. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; Suc na < length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]\<rbrakk> \<Longrightarrow> \<lbrace>valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace> loadWordUser (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) >>= storeWordUser (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) \<lbrace>\<lambda>_. valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace>
 5. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> length TCB_H.msgRegisters + length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] < 2 ^ word_bits
 6. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv'a t t'. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (return_C ret__unsigned_long_'_update i_') (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 7. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; rv'a = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv) (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a) [SKIP] (return (min n (word_of_nat (length TCB_H.msgRegisters) + word_of_nat (Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))))) (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 8. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a\<rbrace> mapM_x (\<lambda>a. loadWordUser (x2 + a * 4) >>= storeWordUser (x2a + a * 4)) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] \<lbrace>?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a\<rbrace>
 9. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])) i_' (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a)
 10. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. (sendBuffer = None \<longrightarrow> True) \<and> (\<forall>x. sendBuffer = Some x \<longrightarrow> (recvBuffer = None \<longrightarrow> True) \<and> (\<forall>xa. recvBuffer = Some xa \<longrightarrow> (unat na \<le> length TCB_H.msgRegisters \<longrightarrow> True) \<and> (\<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> (valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace' and ?R2106 receivera sendera recvBuf sendBuf na rv x xa) s)))\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>x2 x2a. ?R2106 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a proof (prove)
goal (14 subgoals):
 1. \<And>x2 x2a na. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; na < Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2123 x2 x2a na) (?Q'2123 x2 x2a na) [] (loadWordUser (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) >>= storeWordUser (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4)) (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))))))))))))
 2. \<And>x2 x2a na s. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; na < Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)); (valid_ipc_buffer_ptr' x2 and valid_ipc_buffer_ptr' x2a and valid_pspace') s\<rbrakk> \<Longrightarrow> ?Q2123 x2 x2a na s
 3. \<And>x2 x2a na s. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; na < Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)); s \<in> \<lbrace>\<acute>i = word_of_nat (length TCB_H.msgRegisters) + word_of_nat na\<rbrace>\<rbrakk> \<Longrightarrow> s \<in> ?Q'2123 x2 x2a na
 4. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a na. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> (na < n) = (na < word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]))
 5. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))))))))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a na. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; Suc na < length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]\<rbrakk> \<Longrightarrow> \<lbrace>valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace> loadWordUser (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) >>= storeWordUser (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) \<lbrace>\<lambda>_. valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace>
 7. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> length TCB_H.msgRegisters + length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] < 2 ^ word_bits
 8. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv'a t t'. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (return_C ret__unsigned_long_'_update i_') (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 9. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; rv'a = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv) (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a) [SKIP] (return (min n (word_of_nat (length TCB_H.msgRegisters) + word_of_nat (Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))))) (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 10. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a\<rbrace> mapM_x (\<lambda>a. loadWordUser (x2 + a * 4) >>= storeWordUser (x2a + a * 4)) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] \<lbrace>?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>x2 x2a. ?R2106 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a proof (prove)
goal (14 subgoals):
 1. \<And>x2 x2a na rv. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; na < Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2127 x2 x2a na rv) (?Q2127 x2 x2a na rv) [] (storeWordUser (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) rv) (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))))))))))))
 2. \<And>x2 x2a na s. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; na < Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)); (valid_ipc_buffer_ptr' x2 and valid_ipc_buffer_ptr' x2a and valid_pspace') s\<rbrakk> \<Longrightarrow> (valid_pspace' and K (is_aligned (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) 2) and (\<lambda>s. \<forall>v. user_word_at v (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) s \<longrightarrow> ?P2127 x2 x2a na v s)) s
 3. \<And>x2 x2a na s. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; na < Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)); s \<in> \<lbrace>\<acute>i = word_of_nat (length TCB_H.msgRegisters) + word_of_nat na\<rbrace>\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. cslift s (PTR(32 word) (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4)) = Some v \<longrightarrow> s \<in> ?Q2127 x2 x2a na v}
 4. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a na. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> (na < n) = (na < word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]))
 5. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))))))))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a na. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; Suc na < length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]\<rbrakk> \<Longrightarrow> \<lbrace>valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace> loadWordUser (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) >>= storeWordUser (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) \<lbrace>\<lambda>_. valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace>
 7. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> length TCB_H.msgRegisters + length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] < 2 ^ word_bits
 8. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv'a t t'. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (return_C ret__unsigned_long_'_update i_') (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 9. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; rv'a = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv) (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a) [SKIP] (return (min n (word_of_nat (length TCB_H.msgRegisters) + word_of_nat (Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))))) (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 10. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a\<rbrace> mapM_x (\<lambda>a. loadWordUser (x2 + a * 4) >>= storeWordUser (x2a + a * 4)) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] \<lbrace>?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>x2 x2a. ?R2106 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a proof (prove)
goal (14 subgoals):
 1. \<And>x2 x2a na rv. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; na < Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P2127 x2 x2a na rv) (?Q2127 x2 x2a na rv) [] (do stateAssert (pointerInUserData (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4)) [];
doMachineOp $ storeWord (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) rv
od) (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))))))))))))
 2. \<And>x2 x2a na s. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; na < Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)); (valid_ipc_buffer_ptr' x2 and valid_ipc_buffer_ptr' x2a and valid_pspace') s\<rbrakk> \<Longrightarrow> (valid_pspace' and K (is_aligned (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) 2) and (\<lambda>s. \<forall>v. user_word_at v (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) s \<longrightarrow> ?P2127 x2 x2a na v s)) s
 3. \<And>x2 x2a na s. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; na < Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)); s \<in> \<lbrace>\<acute>i = word_of_nat (length TCB_H.msgRegisters) + word_of_nat na\<rbrace>\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. cslift s (PTR(32 word) (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4)) = Some v \<longrightarrow> s \<in> ?Q2127 x2 x2a na v}
 4. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a na. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> (na < n) = (na < word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]))
 5. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))))))))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a na. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; Suc na < length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]\<rbrakk> \<Longrightarrow> \<lbrace>valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace> do a <- loadWordUser (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4);
stateAssert (pointerInUserData (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4)) [];
doMachineOp $ storeWord (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) a
od \<lbrace>\<lambda>_. valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace>
 7. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> length TCB_H.msgRegisters + length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] < 2 ^ word_bits
 8. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv'a t t'. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (return_C ret__unsigned_long_'_update i_') (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 9. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; rv'a = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv) (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a) [SKIP] (return (min n (word_of_nat (length TCB_H.msgRegisters) + word_of_nat (Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))))) (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 10. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a\<rbrace> mapM_x (\<lambda>a. do b <- loadWordUser (x2 + a * 4);
stateAssert (pointerInUserData (x2a + a * 4)) [];
doMachineOp $ storeWord (x2a + a * 4) b
od) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] \<lbrace>?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>x2 x2a. ?R2106 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a proof (prove)
goal (14 subgoals):
 1. \<And>x2 x2a na rv rva. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; na < Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2129 x2 x2a na rv rva) (?Q'2129 x2 x2a na rv rva) [] (K_bind (doMachineOp $ storeWord (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) rv) rva) (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))))))))))))
 2. \<And>x2 x2a na s. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; na < Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)); (valid_ipc_buffer_ptr' x2 and valid_ipc_buffer_ptr' x2a and valid_pspace') s\<rbrakk> \<Longrightarrow> (valid_pspace' and K (is_aligned (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) 2) and (\<lambda>s. \<forall>v. user_word_at v (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) s \<longrightarrow> pointerInUserData (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) s \<longrightarrow> ?Q2129 x2 x2a na v () s)) s
 3. \<And>x2 x2a na s. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; na < Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)); s \<in> \<lbrace>\<acute>i = word_of_nat (length TCB_H.msgRegisters) + word_of_nat na\<rbrace>\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. cslift s (PTR(32 word) (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4)) = Some v \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ?Q2129 x2 x2a na v rv s \<longrightarrow> s' \<in> ?Q'2129 x2 x2a na v rv}}
 4. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a na. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> (na < n) = (na < word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]))
 5. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))))))))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a na. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; Suc na < length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]\<rbrakk> \<Longrightarrow> \<lbrace>valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace> do a <- loadWordUser (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4);
stateAssert (pointerInUserData (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4)) [];
doMachineOp $ storeWord (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) a
od \<lbrace>\<lambda>_. valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace>
 7. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> length TCB_H.msgRegisters + length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] < 2 ^ word_bits
 8. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv'a t t'. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (return_C ret__unsigned_long_'_update i_') (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 9. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; rv'a = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv) (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a) [SKIP] (return (min n (word_of_nat (length TCB_H.msgRegisters) + word_of_nat (Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))))) (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 10. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a\<rbrace> mapM_x (\<lambda>a. do b <- loadWordUser (x2 + a * 4);
stateAssert (pointerInUserData (x2a + a * 4)) [];
doMachineOp $ storeWord (x2a + a * 4) b
od) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] \<lbrace>?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>x2 x2a. ?R2106 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a proof (prove)
goal (14 subgoals):
 1. \<And>x2 x2a na rv rva. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; na < Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2129 x2 x2a na rv rva) (?Q'2129 x2 x2a na rv rva) [] (doMachineOp $ storeWord (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) rv) (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))))))))))))
 2. \<And>x2 x2a na s. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; na < Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)); (valid_ipc_buffer_ptr' x2 and valid_ipc_buffer_ptr' x2a and valid_pspace') s\<rbrakk> \<Longrightarrow> (valid_pspace' and K (is_aligned (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) 2) and (\<lambda>s. \<forall>v. user_word_at v (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) s \<longrightarrow> pointerInUserData (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) s \<longrightarrow> ?Q2129 x2 x2a na v () s)) s
 3. \<And>x2 x2a na s. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; na < Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)); s \<in> \<lbrace>\<acute>i = word_of_nat (length TCB_H.msgRegisters) + word_of_nat na\<rbrace>\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. cslift s (PTR(32 word) (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4)) = Some v \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ?Q2129 x2 x2a na v rv s \<longrightarrow> s' \<in> ?Q'2129 x2 x2a na v rv}}
 4. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a na. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> (na < n) = (na < word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]))
 5. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))))))))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a na. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; Suc na < length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]\<rbrakk> \<Longrightarrow> \<lbrace>valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace> do a <- loadWordUser (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4);
y <- stateAssert (pointerInUserData (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4)) [];
doMachineOp $ storeWord (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) a
od \<lbrace>\<lambda>_. valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace>
 7. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> length TCB_H.msgRegisters + length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] < 2 ^ word_bits
 8. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv'a t t'. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (return_C ret__unsigned_long_'_update i_') (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 9. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; rv'a = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv) (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a) [SKIP] (return (min n (word_of_nat (length TCB_H.msgRegisters) + word_of_nat (Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))))) (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 10. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a\<rbrace> mapM_x (\<lambda>a. do b <- loadWordUser (x2 + a * 4);
y <- stateAssert (pointerInUserData (x2a + a * 4)) [];
doMachineOp $ storeWord (x2a + a * 4) b
od) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] \<lbrace>?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>x2 x2a. ?R2106 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a proof (prove)
goal (14 subgoals):
 1. \<And>x2 x2a na rv rva. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; na < Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A2150 x2 x2a na rv rva) (?C'2150 x2 x2a na rv rva) [] (doMachineOp $ storeWord (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) rv) (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))))))
 2. \<And>x2 x2a na s. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; na < Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)); (valid_ipc_buffer_ptr' x2 and valid_ipc_buffer_ptr' x2a and valid_pspace') s\<rbrakk> \<Longrightarrow> (valid_pspace' and K (is_aligned (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) 2) and (\<lambda>s. \<forall>v. user_word_at v (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) s \<longrightarrow> pointerInUserData (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) s \<longrightarrow> (?A2150 x2 x2a na v () and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2a)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2a))) s)) s
 3. \<And>x2 x2a na s. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; na < Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)); s \<in> \<lbrace>\<acute>i = word_of_nat (length TCB_H.msgRegisters) + word_of_nat na\<rbrace>\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. cslift s (PTR(32 word) (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4)) = Some v \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (?A2150 x2 x2a na v rv and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2a)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2a))) s \<longrightarrow> s' \<in> ?C'2150 x2 x2a na v rv \<inter> \<lbrace>Suc (unat (\<acute>i + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> Suc (unat (\<acute>i + 1)) \<noteq> 0)\<rbrace> \<inter> \<lbrace>Suc (unat (\<acute>i + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> Suc (unat (\<acute>i + 1)) \<noteq> 0)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} \<inter> \<lbrace>unat (\<acute>i + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> unat (\<acute>i + 1) \<noteq> 0)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} \<inter> \<lbrace>unat (\<acute>i + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> unat (\<acute>i + 1) \<noteq> 0)\<rbrace>}}
 4. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a na. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> (na < n) = (na < word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]))
 5. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))))))))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 6. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a na. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; Suc na < length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]\<rbrakk> \<Longrightarrow> \<lbrace>valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace> do a <- loadWordUser (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4);
y <- stateAssert (pointerInUserData (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4)) [];
doMachineOp $ storeWord (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) a
od \<lbrace>\<lambda>_. valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace>
 7. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> length TCB_H.msgRegisters + length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] < 2 ^ word_bits
 8. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv'a t t'. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (return_C ret__unsigned_long_'_update i_') (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 9. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; rv'a = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv) (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a) [SKIP] (return (min n (word_of_nat (length TCB_H.msgRegisters) + word_of_nat (Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))))) (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 10. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a\<rbrace> mapM_x (\<lambda>a. do b <- loadWordUser (x2 + a * 4);
y <- stateAssert (pointerInUserData (x2a + a * 4)) [];
doMachineOp $ storeWord (x2a + a * 4) b
od) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] \<lbrace>?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a\<rbrace>
A total of 14 subgoals...
flex-flex pairs:
\<lambda>x2 x2a. ?R2106 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a proof (prove)
goal (13 subgoals):
 1. \<And>x2 x2a na s. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; na < Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)); (valid_ipc_buffer_ptr' x2 and valid_ipc_buffer_ptr' x2a and valid_pspace') s\<rbrakk> \<Longrightarrow> (valid_pspace' and K (is_aligned (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) 2) and (\<lambda>s. \<forall>v. user_word_at v (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) s \<longrightarrow> pointerInUserData (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) s \<longrightarrow> (valid_pspace' and K (is_aligned (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) 2) and pointerInUserData (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2a)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2a))) s)) s
 2. \<And>x2 x2a na s. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; na < Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)); s \<in> \<lbrace>\<acute>i = word_of_nat (length TCB_H.msgRegisters) + word_of_nat na\<rbrace>\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. cslift s (PTR(32 word) (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4)) = Some v \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_pspace' and K (is_aligned (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) 2) and pointerInUserData (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2a)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2a))) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>PTR(32 word) (x2a + (\<acute>i * 4 + 4)) = PTR(32 word) (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4)\<rbrace> \<inter> \<lbrace>c_guard (PTR(32 word) (x2a + (\<acute>i * 4 + 4)))\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))) = v\<rbrace> \<inter> \<lbrace>Suc (unat (\<acute>i + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> Suc (unat (\<acute>i + 1)) \<noteq> 0)\<rbrace> \<inter> \<lbrace>Suc (unat (\<acute>i + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> Suc (unat (\<acute>i + 1)) \<noteq> 0)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} \<inter> \<lbrace>unat (\<acute>i + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> unat (\<acute>i + 1) \<noteq> 0)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} \<inter> \<lbrace>unat (\<acute>i + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> unat (\<acute>i + 1) \<noteq> 0)\<rbrace>}}
 3. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a na. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> (na < n) = (na < word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]))
 4. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))))))))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a na. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; Suc na < length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]\<rbrakk> \<Longrightarrow> \<lbrace>valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace> do a <- loadWordUser (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4);
y <- stateAssert (pointerInUserData (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4)) [];
doMachineOp $ storeWord (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) a
od \<lbrace>\<lambda>_. valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace>
 6. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> length TCB_H.msgRegisters + length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] < 2 ^ word_bits
 7. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv'a t t'. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (return_C ret__unsigned_long_'_update i_') (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 8. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; rv'a = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv) (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a) [SKIP] (return (min n (word_of_nat (length TCB_H.msgRegisters) + word_of_nat (Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))))) (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 9. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a\<rbrace> mapM_x (\<lambda>a. do b <- loadWordUser (x2 + a * 4);
y <- stateAssert (pointerInUserData (x2a + a * 4)) [];
doMachineOp $ storeWord (x2a + a * 4) b
od) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] \<lbrace>?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a\<rbrace>
 10. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])) i_' (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a)
A total of 13 subgoals...
flex-flex pairs:
\<lambda>x2 x2a. ?R2106 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a proof (prove)
goal (12 subgoals):
 1. \<And>x2 x2a na s. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; na < Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)); s \<in> \<lbrace>\<acute>i = word_of_nat (length TCB_H.msgRegisters) + word_of_nat na\<rbrace>\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. cslift s (PTR(32 word) (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4)) = Some v \<longrightarrow> s \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (valid_pspace' and K (is_aligned (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) 2) and pointerInUserData (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2a)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2)) and valid_ipc_buffer_ptr' (ptr_val (PTR(32 word) x2a))) s \<longrightarrow> s' \<in> UNIV \<inter> \<lbrace>PTR(32 word) (x2a + (\<acute>i * 4 + 4)) = PTR(32 word) (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4)\<rbrace> \<inter> \<lbrace>c_guard (PTR(32 word) (x2a + (\<acute>i * 4 + 4)))\<rbrace> \<inter> \<lbrace>h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4))) = v\<rbrace> \<inter> \<lbrace>Suc (unat (\<acute>i + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> Suc (unat (\<acute>i + 1)) \<noteq> 0)\<rbrace> \<inter> \<lbrace>Suc (unat (\<acute>i + 1)) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> Suc (unat (\<acute>i + 1)) \<noteq> 0)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} \<inter> \<lbrace>unat (\<acute>i + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> unat (\<acute>i + 1) \<noteq> 0)\<rbrace> \<inter> {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} \<inter> \<lbrace>unat (\<acute>i + 1) \<le> 2 ^ (msg_align_bits - 2) \<and> (\<acute>i + 1 \<noteq> 0 \<longrightarrow> unat (\<acute>i + 1) \<noteq> 0)\<rbrace>}}
 2. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a na. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> (na < n) = (na < word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]))
 3. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))))))))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a na. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; Suc na < length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]\<rbrakk> \<Longrightarrow> \<lbrace>valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace> do a <- loadWordUser (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4);
y <- stateAssert (pointerInUserData (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4)) [];
doMachineOp $ storeWord (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) a
od \<lbrace>\<lambda>_. valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace>
 5. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> length TCB_H.msgRegisters + length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] < 2 ^ word_bits
 6. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv'a t t'. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (return_C ret__unsigned_long_'_update i_') (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 7. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; rv'a = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv) (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a) [SKIP] (return (min n (word_of_nat (length TCB_H.msgRegisters) + word_of_nat (Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))))) (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 8. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a\<rbrace> mapM_x (\<lambda>a. do b <- loadWordUser (x2 + a * 4);
y <- stateAssert (pointerInUserData (x2a + a * 4)) [];
doMachineOp $ storeWord (x2a + a * 4) b
od) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] \<lbrace>?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a\<rbrace>
 9. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])) i_' (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a)
 10. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. (sendBuffer = None \<longrightarrow> True) \<and> (\<forall>x. sendBuffer = Some x \<longrightarrow> (recvBuffer = None \<longrightarrow> True) \<and> (\<forall>xa. recvBuffer = Some xa \<longrightarrow> (unat na \<le> length TCB_H.msgRegisters \<longrightarrow> True) \<and> (\<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> (valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace' and ?R2106 receivera sendera recvBuf sendBuf na rv x xa) s)))\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>x2 x2a. ?R2106 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a proof (prove)
goal (12 subgoals):
 1. \<And>x2 x2a na s v sa. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; n = n && mask msgLengthBits; Suc (Suc (Suc (Suc 0))) < 2 ^ word_bits; sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> Suc (Suc (Suc (Suc 0))); na < unat n - 4; i_' s = 4 + word_of_nat na; cslift s (PTR(32 word) (x2 + (0x14 + word_of_nat na * 4))) = Some v; (sa, s) \<in> rf_sr; valid_pspace' sa; is_aligned (x2a + (0x14 + word_of_nat na * 4)) 2; pointerInUserData (x2a + (0x14 + word_of_nat na * 4)) sa; valid_ipc_buffer_ptr' x2 sa; valid_ipc_buffer_ptr' x2a sa\<rbrakk> \<Longrightarrow> Suc (unat (5 + word_of_nat na)) \<le> 2 ^ (msg_align_bits - 2) \<and> unat (5 + word_of_nat na) \<le> 2 ^ (msg_align_bits - 2) \<and> (5 + word_of_nat na \<noteq> 0 \<longrightarrow> 0 < unat (5 + word_of_nat na)) \<and> unat (5 + word_of_nat na) \<le> 2 ^ (msg_align_bits - 2) \<and> (5 + word_of_nat na \<noteq> 0 \<longrightarrow> 0 < unat (5 + word_of_nat na))
 2. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a na. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> (na < n) = (na < word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]))
 3. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))))))))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a na. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; Suc na < length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]\<rbrakk> \<Longrightarrow> \<lbrace>valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace> do a <- loadWordUser (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4);
y <- stateAssert (pointerInUserData (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4)) [];
doMachineOp $ storeWord (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) a
od \<lbrace>\<lambda>_. valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace>
 5. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> length TCB_H.msgRegisters + length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] < 2 ^ word_bits
 6. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv'a t t'. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (return_C ret__unsigned_long_'_update i_') (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 7. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; rv'a = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv) (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a) [SKIP] (return (min n (word_of_nat (length TCB_H.msgRegisters) + word_of_nat (Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))))) (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 8. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a\<rbrace> mapM_x (\<lambda>a. do b <- loadWordUser (x2 + a * 4);
y <- stateAssert (pointerInUserData (x2a + a * 4)) [];
doMachineOp $ storeWord (x2a + a * 4) b
od) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] \<lbrace>?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a\<rbrace>
 9. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])) i_' (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a)
 10. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. (sendBuffer = None \<longrightarrow> True) \<and> (\<forall>x. sendBuffer = Some x \<longrightarrow> (recvBuffer = None \<longrightarrow> True) \<and> (\<forall>xa. recvBuffer = Some xa \<longrightarrow> (unat na \<le> length TCB_H.msgRegisters \<longrightarrow> True) \<and> (\<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> (valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace' and ?R2106 receivera sendera recvBuf sendBuf na rv x xa) s)))\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>x2 x2a. ?R2106 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a proof (prove)
goal (12 subgoals):
 1. \<And>x2 x2a na s v sa. \<lbrakk>unat n \<le> 120; 0 < unat x2a; 0 < unat x2; n = n && mask msgLengthBits; Suc (Suc (Suc (Suc 0))) < 2 ^ word_bits; sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> Suc (Suc (Suc (Suc 0))); na < unat n - 4; unat (i_' s) = (if na < 4294967292 then unat 4 + na mod 2 ^ LENGTH(32) else unat 4 + na mod 2 ^ LENGTH(32) - 2 ^ LENGTH(32)); cslift s (PTR(32 word) (x2 + (0x14 + word_of_nat na * 4))) = Some v; (sa, s) \<in> rf_sr; valid_pspace' sa; is_aligned (x2a + (0x14 + word_of_nat na * 4)) 2; pointerInUserData (x2a + (0x14 + word_of_nat na * 4)) sa; valid_ipc_buffer_ptr' x2 sa; valid_ipc_buffer_ptr' x2a sa\<rbrakk> \<Longrightarrow> na < 4294967291 \<longrightarrow> na \<le> 122 \<and> na \<le> 123
 2. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a na. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> (na < n) = (na < word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]))
 3. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))))))))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a na. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; Suc na < length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]\<rbrakk> \<Longrightarrow> \<lbrace>valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace> do a <- loadWordUser (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4);
y <- stateAssert (pointerInUserData (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4)) [];
doMachineOp $ storeWord (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) a
od \<lbrace>\<lambda>_. valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace>
 5. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> length TCB_H.msgRegisters + length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] < 2 ^ word_bits
 6. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv'a t t'. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (return_C ret__unsigned_long_'_update i_') (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 7. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; rv'a = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv) (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a) [SKIP] (return (min n (word_of_nat (length TCB_H.msgRegisters) + word_of_nat (Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))))) (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 8. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a\<rbrace> mapM_x (\<lambda>a. do b <- loadWordUser (x2 + a * 4);
y <- stateAssert (pointerInUserData (x2a + a * 4)) [];
doMachineOp $ storeWord (x2a + a * 4) b
od) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] \<lbrace>?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a\<rbrace>
 9. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])) i_' (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a)
 10. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. (sendBuffer = None \<longrightarrow> True) \<and> (\<forall>x. sendBuffer = Some x \<longrightarrow> (recvBuffer = None \<longrightarrow> True) \<and> (\<forall>xa. recvBuffer = Some xa \<longrightarrow> (unat na \<le> length TCB_H.msgRegisters \<longrightarrow> True) \<and> (\<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> (valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace' and ?R2106 receivera sendera recvBuf sendBuf na rv x xa) s)))\<rbrace>
A total of 12 subgoals...
flex-flex pairs:
\<lambda>x2 x2a. ?R2106 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a proof (prove)
goal (11 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a na. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> (na < n) = (na < word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]))
 2. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))))))))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 3. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a na. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; Suc na < length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]\<rbrakk> \<Longrightarrow> \<lbrace>valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace> do a <- loadWordUser (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4);
y <- stateAssert (pointerInUserData (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4)) [];
doMachineOp $ storeWord (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) a
od \<lbrace>\<lambda>_. valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace>
 4. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> length TCB_H.msgRegisters + length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] < 2 ^ word_bits
 5. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv'a t t'. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (return_C ret__unsigned_long_'_update i_') (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 6. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; rv'a = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv) (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a) [SKIP] (return (min n (word_of_nat (length TCB_H.msgRegisters) + word_of_nat (Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))))) (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 7. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a\<rbrace> mapM_x (\<lambda>a. do b <- loadWordUser (x2 + a * 4);
y <- stateAssert (pointerInUserData (x2a + a * 4)) [];
doMachineOp $ storeWord (x2a + a * 4) b
od) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] \<lbrace>?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a\<rbrace>
 8. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])) i_' (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a)
 9. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. (sendBuffer = None \<longrightarrow> True) \<and> (\<forall>x. sendBuffer = Some x \<longrightarrow> (recvBuffer = None \<longrightarrow> True) \<and> (\<forall>xa. recvBuffer = Some xa \<longrightarrow> (unat na \<le> length TCB_H.msgRegisters \<longrightarrow> True) \<and> (\<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> (valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace' and ?R2106 receivera sendera recvBuf sendBuf na rv x xa) s)))\<rbrace>
 10. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (\<lambda>rv rv'. {s. sendBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. sendBuffer = Some x \<longrightarrow> s \<in> {s. recvBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. recvBuffer = Some x \<longrightarrow> s \<in> {s. unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> \<lbrace>rv' = \<acute>i && mask msgLengthBits\<rbrace> \<inter> - \<lbrace>\<acute>i < rv'\<rbrace>} \<inter> {s. \<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = rv'\<rbrace>}}}}})
A total of 11 subgoals...
flex-flex pairs:
\<lambda>x2 x2a. ?R2106 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a proof (prove)
goal (10 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (\<acute>i + 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' s * 4 + 4))} (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (\<acute>i + 1))) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (PTR(32 word) (x2a + (\<acute>i * 4 + 4))) (h_val (hrs_mem \<acute>t_hrs) (PTR(32 word) (x2 + (\<acute>i * 4 + 4)))))))))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 2. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a na. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; Suc na < length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]\<rbrakk> \<Longrightarrow> \<lbrace>valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace> do a <- loadWordUser (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4);
y <- stateAssert (pointerInUserData (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4)) [];
doMachineOp $ storeWord (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) a
od \<lbrace>\<lambda>_. valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace>
 3. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> length TCB_H.msgRegisters + length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] < 2 ^ word_bits
 4. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv'a t t'. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (return_C ret__unsigned_long_'_update i_') (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 5. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; rv'a = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv) (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a) [SKIP] (return (min n (word_of_nat (length TCB_H.msgRegisters) + word_of_nat (Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))))) (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 6. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a\<rbrace> mapM_x (\<lambda>a. do b <- loadWordUser (x2 + a * 4);
y <- stateAssert (pointerInUserData (x2a + a * 4)) [];
doMachineOp $ storeWord (x2a + a * 4) b
od) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] \<lbrace>?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a\<rbrace>
 7. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])) i_' (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a)
 8. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. (sendBuffer = None \<longrightarrow> True) \<and> (\<forall>x. sendBuffer = Some x \<longrightarrow> (recvBuffer = None \<longrightarrow> True) \<and> (\<forall>xa. recvBuffer = Some xa \<longrightarrow> (unat na \<le> length TCB_H.msgRegisters \<longrightarrow> True) \<and> (\<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> (valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace' and ?R2106 receivera sendera recvBuf sendBuf na rv x xa) s)))\<rbrace>
 9. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (\<lambda>rv rv'. {s. sendBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. sendBuffer = Some x \<longrightarrow> s \<in> {s. recvBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. recvBuffer = Some x \<longrightarrow> s \<in> {s. unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> \<lbrace>rv' = \<acute>i && mask msgLengthBits\<rbrace> \<inter> - \<lbrace>\<acute>i < rv'\<rbrace>} \<inter> {s. \<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = rv'\<rbrace>}}}}})
 10. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>x2 x2a. ?R2106 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a proof (prove)
goal (10 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a s. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> {s} \<subseteq> {sa. i_' sa + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (unat (i_' sa + 1)) (hrs_htd (t_hrs_' (globals sa))) \<longrightarrow> sa \<Turnstile>\<^sub>c PTR(32 word) (x2a + (i_' sa * 4 + 4)) \<longrightarrow> i_' sa + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (unat (i_' sa + 1)) (hrs_htd (t_hrs_' (globals sa))) \<longrightarrow> sa \<Turnstile>\<^sub>c PTR(32 word) (x2 + (i_' sa * 4 + 4)) \<longrightarrow> i_' sa + 1 = 0 \<or> array_assertion (PTR(32 word) x2a) (Suc (unat (i_' sa + 1))) (hrs_htd (t_hrs_' (globals sa))) \<longrightarrow> i_' sa + 1 = 0 \<or> array_assertion (PTR(32 word) x2) (Suc (unat (i_' sa + 1))) (hrs_htd (t_hrs_' (globals sa))) \<longrightarrow> i_' sa = i_' s}
 2. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a na. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; Suc na < length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]\<rbrakk> \<Longrightarrow> \<lbrace>valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace> do a <- loadWordUser (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4);
y <- stateAssert (pointerInUserData (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4)) [];
doMachineOp $ storeWord (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) a
od \<lbrace>\<lambda>_. valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace>
 3. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> length TCB_H.msgRegisters + length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] < 2 ^ word_bits
 4. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv'a t t'. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (return_C ret__unsigned_long_'_update i_') (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 5. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; rv'a = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv) (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a) [SKIP] (return (min n (word_of_nat (length TCB_H.msgRegisters) + word_of_nat (Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))))) (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 6. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a\<rbrace> mapM_x (\<lambda>a. do b <- loadWordUser (x2 + a * 4);
y <- stateAssert (pointerInUserData (x2a + a * 4)) [];
doMachineOp $ storeWord (x2a + a * 4) b
od) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] \<lbrace>?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a\<rbrace>
 7. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])) i_' (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a)
 8. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. (sendBuffer = None \<longrightarrow> True) \<and> (\<forall>x. sendBuffer = Some x \<longrightarrow> (recvBuffer = None \<longrightarrow> True) \<and> (\<forall>xa. recvBuffer = Some xa \<longrightarrow> (unat na \<le> length TCB_H.msgRegisters \<longrightarrow> True) \<and> (\<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> (valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace' and ?R2106 receivera sendera recvBuf sendBuf na rv x xa) s)))\<rbrace>
 9. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (\<lambda>rv rv'. {s. sendBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. sendBuffer = Some x \<longrightarrow> s \<in> {s. recvBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. recvBuffer = Some x \<longrightarrow> s \<in> {s. unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> \<lbrace>rv' = \<acute>i && mask msgLengthBits\<rbrace> \<inter> - \<lbrace>\<acute>i < rv'\<rbrace>} \<inter> {s. \<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = rv'\<rbrace>}}}}})
 10. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>x2 x2a. ?R2106 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a proof (prove)
goal (9 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a na. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; Suc na < length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]\<rbrakk> \<Longrightarrow> \<lbrace>valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace> do a <- loadWordUser (x2 + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4);
y <- stateAssert (pointerInUserData (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4)) [];
doMachineOp $ storeWord (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) a
od \<lbrace>\<lambda>_. valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace'\<rbrace>
 2. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> length TCB_H.msgRegisters + length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] < 2 ^ word_bits
 3. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv'a t t'. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (return_C ret__unsigned_long_'_update i_') (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 4. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; rv'a = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv) (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a) [SKIP] (return (min n (word_of_nat (length TCB_H.msgRegisters) + word_of_nat (Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))))) (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 5. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a\<rbrace> mapM_x (\<lambda>a. do b <- loadWordUser (x2 + a * 4);
y <- stateAssert (pointerInUserData (x2a + a * 4)) [];
doMachineOp $ storeWord (x2a + a * 4) b
od) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] \<lbrace>?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a\<rbrace>
 6. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])) i_' (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a)
 7. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. (sendBuffer = None \<longrightarrow> True) \<and> (\<forall>x. sendBuffer = Some x \<longrightarrow> (recvBuffer = None \<longrightarrow> True) \<and> (\<forall>xa. recvBuffer = Some xa \<longrightarrow> (unat na \<le> length TCB_H.msgRegisters \<longrightarrow> True) \<and> (\<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> (valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace' and ?R2106 receivera sendera recvBuf sendBuf na rv x xa) s)))\<rbrace>
 8. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (\<lambda>rv rv'. {s. sendBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. sendBuffer = Some x \<longrightarrow> s \<in> {s. recvBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. recvBuffer = Some x \<longrightarrow> s \<in> {s. unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> \<lbrace>rv' = \<acute>i && mask msgLengthBits\<rbrace> \<inter> - \<lbrace>\<acute>i < rv'\<rbrace>} \<inter> {s. \<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = rv'\<rbrace>}}}}})
 9. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>x2 x2a. ?R2106 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a proof (prove)
goal (9 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a na s. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; Suc na < length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n]; (valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace') s\<rbrakk> \<Longrightarrow> valid_ipc_buffer_ptr' (the sendBuffer) s \<and> valid_ipc_buffer_ptr' (the recvBuffer) s \<and> (pointerInUserData (x2a + [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] ! na * 4) s \<longrightarrow> valid_pspace' s)
 2. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> length TCB_H.msgRegisters + length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] < 2 ^ word_bits
 3. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv'a t t'. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (return_C ret__unsigned_long_'_update i_') (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 4. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; rv'a = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv) (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a) [SKIP] (return (min n (word_of_nat (length TCB_H.msgRegisters) + word_of_nat (Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))))) (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 5. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a\<rbrace> mapM_x (\<lambda>a. do b <- loadWordUser (x2 + a * 4);
y <- stateAssert (pointerInUserData (x2a + a * 4)) [];
doMachineOp $ storeWord (x2a + a * 4) b
od) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] \<lbrace>?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a\<rbrace>
 6. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])) i_' (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a)
 7. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. (sendBuffer = None \<longrightarrow> True) \<and> (\<forall>x. sendBuffer = Some x \<longrightarrow> (recvBuffer = None \<longrightarrow> True) \<and> (\<forall>xa. recvBuffer = Some xa \<longrightarrow> (unat na \<le> length TCB_H.msgRegisters \<longrightarrow> True) \<and> (\<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> (valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace' and ?R2106 receivera sendera recvBuf sendBuf na rv x xa) s)))\<rbrace>
 8. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (\<lambda>rv rv'. {s. sendBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. sendBuffer = Some x \<longrightarrow> s \<in> {s. recvBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. recvBuffer = Some x \<longrightarrow> s \<in> {s. unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> \<lbrace>rv' = \<acute>i && mask msgLengthBits\<rbrace> \<inter> - \<lbrace>\<acute>i < rv'\<rbrace>} \<inter> {s. \<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = rv'\<rbrace>}}}}})
 9. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>x2 x2a. ?R2106 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a proof (prove)
goal (8 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> length TCB_H.msgRegisters + length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] < 2 ^ word_bits
 2. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv'a t t'. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (return_C ret__unsigned_long_'_update i_') (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 3. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; rv'a = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv) (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a) [SKIP] (return (min n (word_of_nat (length TCB_H.msgRegisters) + word_of_nat (Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))))) (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 4. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a\<rbrace> mapM_x (\<lambda>a. do b <- loadWordUser (x2 + a * 4);
y <- stateAssert (pointerInUserData (x2a + a * 4)) [];
doMachineOp $ storeWord (x2a + a * 4) b
od) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] \<lbrace>?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a\<rbrace>
 5. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])) i_' (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a)
 6. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. (sendBuffer = None \<longrightarrow> True) \<and> (\<forall>x. sendBuffer = Some x \<longrightarrow> (recvBuffer = None \<longrightarrow> True) \<and> (\<forall>xa. recvBuffer = Some xa \<longrightarrow> (unat na \<le> length TCB_H.msgRegisters \<longrightarrow> True) \<and> (\<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> (valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace' and ?R2106 receivera sendera recvBuf sendBuf na rv x xa) s)))\<rbrace>
 7. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (\<lambda>rv rv'. {s. sendBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. sendBuffer = Some x \<longrightarrow> s \<in> {s. recvBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. recvBuffer = Some x \<longrightarrow> s \<in> {s. unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> \<lbrace>rv' = \<acute>i && mask msgLengthBits\<rbrace> \<inter> - \<lbrace>\<acute>i < rv'\<rbrace>} \<inter> {s. \<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = rv'\<rbrace>}}}}})
 8. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>x2 x2a. ?R2106 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a proof (prove)
goal (7 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv'a t t'. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv'a t t' (return_C ret__unsigned_long_'_update i_') (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 2. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; rv'a = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv) (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a) [SKIP] (return (min n (word_of_nat (length TCB_H.msgRegisters) + word_of_nat (Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))))) (?d'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv'a)
 3. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a\<rbrace> mapM_x (\<lambda>a. do b <- loadWordUser (x2 + a * 4);
y <- stateAssert (pointerInUserData (x2a + a * 4)) [];
doMachineOp $ storeWord (x2a + a * 4) b
od) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] \<lbrace>?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a\<rbrace>
 4. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])) i_' (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a)
 5. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. (sendBuffer = None \<longrightarrow> True) \<and> (\<forall>x. sendBuffer = Some x \<longrightarrow> (recvBuffer = None \<longrightarrow> True) \<and> (\<forall>xa. recvBuffer = Some xa \<longrightarrow> (unat na \<le> length TCB_H.msgRegisters \<longrightarrow> True) \<and> (\<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> (valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace' and ?R2106 receivera sendera recvBuf sendBuf na rv x xa) s)))\<rbrace>
 6. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (\<lambda>rv rv'. {s. sendBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. sendBuffer = Some x \<longrightarrow> s \<in> {s. recvBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. recvBuffer = Some x \<longrightarrow> s \<in> {s. unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> \<lbrace>rv' = \<acute>i && mask msgLengthBits\<rbrace> \<inter> - \<lbrace>\<acute>i < rv'\<rbrace>} \<inter> {s. \<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = rv'\<rbrace>}}}}})
 7. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>x2 x2a. ?R2106 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a proof (prove)
goal (6 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; rv'a = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv) (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a rv rv'a) [SKIP] (return (min n (word_of_nat (length TCB_H.msgRegisters) + word_of_nat (Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))))) (return_C ret__unsigned_long_'_update (\<lambda>a. rv'a))
 2. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a\<rbrace> mapM_x (\<lambda>a. do b <- loadWordUser (x2 + a * 4);
y <- stateAssert (pointerInUserData (x2a + a * 4)) [];
doMachineOp $ storeWord (x2a + a * 4) b
od) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] \<lbrace>?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a\<rbrace>
 3. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])) i_' (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a)
 4. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. (sendBuffer = None \<longrightarrow> True) \<and> (\<forall>x. sendBuffer = Some x \<longrightarrow> (recvBuffer = None \<longrightarrow> True) \<and> (\<forall>xa. recvBuffer = Some xa \<longrightarrow> (unat na \<le> length TCB_H.msgRegisters \<longrightarrow> True) \<and> (\<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> (valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace' and ?R2106 receivera sendera recvBuf sendBuf na rv x xa) s)))\<rbrace>
 5. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (\<lambda>rv rv'. {s. sendBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. sendBuffer = Some x \<longrightarrow> s \<in> {s. recvBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. recvBuffer = Some x \<longrightarrow> s \<in> {s. unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> \<lbrace>rv' = \<acute>i && mask msgLengthBits\<rbrace> \<inter> - \<lbrace>\<acute>i < rv'\<rbrace>} \<inter> {s. \<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = rv'\<rbrace>}}}}})
 6. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>x2 x2a. ?R2106 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a proof (prove)
goal (6 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a rv'a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters; rv'a = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))\<rbrakk> \<Longrightarrow> ccorres (\<lambda>r r'. r = r' && mask msgLengthBits) ret__unsigned_long_' (?Q2096 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) (word_of_nat (length TCB_H.msgRegisters)) x2 x2a ()) (?Q'2096 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) (word_of_nat (length TCB_H.msgRegisters)) x2 x2a () (word_of_nat (length TCB_H.msgRegisters) + word_of_nat (Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters))))) [SKIP] (return (min n (word_of_nat (length TCB_H.msgRegisters) + word_of_nat (Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))))) (return_C ret__unsigned_long_'_update (\<lambda>a. word_of_nat (length TCB_H.msgRegisters) + word_of_nat (Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))))
 2. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a\<rbrace> mapM_x (\<lambda>a. do b <- loadWordUser (x2 + a * 4);
y <- stateAssert (pointerInUserData (x2a + a * 4)) [];
doMachineOp $ storeWord (x2a + a * 4) b
od) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] \<lbrace>?Q2096 receivera sendera recvBuf sendBuf rv' x2 x2a\<rbrace>
 3. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])) i_' (?Q'2096 receivera sendera recvBuf sendBuf rv' x2 x2a)
 4. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. (sendBuffer = None \<longrightarrow> True) \<and> (\<forall>x. sendBuffer = Some x \<longrightarrow> (recvBuffer = None \<longrightarrow> True) \<and> (\<forall>xa. recvBuffer = Some xa \<longrightarrow> (unat na \<le> length TCB_H.msgRegisters \<longrightarrow> True) \<and> (\<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> (valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace' and ?R2106 receivera sendera recvBuf sendBuf na rv x xa) s)))\<rbrace>
 5. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (\<lambda>rv rv'. {s. sendBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. sendBuffer = Some x \<longrightarrow> s \<in> {s. recvBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. recvBuffer = Some x \<longrightarrow> s \<in> {s. unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> \<lbrace>rv' = \<acute>i && mask msgLengthBits\<rbrace> \<inter> - \<lbrace>\<acute>i < rv'\<rbrace>} \<inter> {s. \<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = rv'\<rbrace>}}}}})
 6. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>x2 x2a. ?R2106 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a proof (prove)
goal (5 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> \<lbrace>?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a\<rbrace> mapM_x (\<lambda>a. do b <- loadWordUser (x2 + a * 4);
y <- stateAssert (pointerInUserData (x2a + a * 4)) [];
doMachineOp $ storeWord (x2a + a * 4) b
od) [1 + word_of_nat (length TCB_H.msgRegisters) .e. n] \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])) i_' (\<lambda>a b. \<lbrace>min n b = b && mask msgLengthBits\<rbrace>)
 3. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. (sendBuffer = None \<longrightarrow> True) \<and> (\<forall>x. sendBuffer = Some x \<longrightarrow> (recvBuffer = None \<longrightarrow> True) \<and> (\<forall>xa. recvBuffer = Some xa \<longrightarrow> (unat na \<le> length TCB_H.msgRegisters \<longrightarrow> True) \<and> (\<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> (valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace' and ?R2106 receivera sendera recvBuf sendBuf na rv x xa) s)))\<rbrace>
 4. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (\<lambda>rv rv'. {s. sendBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. sendBuffer = Some x \<longrightarrow> s \<in> {s. recvBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. recvBuffer = Some x \<longrightarrow> s \<in> {s. unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> \<lbrace>rv' = \<acute>i && mask msgLengthBits\<rbrace> \<inter> - \<lbrace>\<acute>i < rv'\<rbrace>} \<inter> {s. \<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = rv'\<rbrace>}}}}})
 5. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV
flex-flex pairs:
\<lambda>x2 x2a. ?R2106 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a \<equiv>\<^sup>? \<lambda>x2 x2a. ?R2102 x2 x2a (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) x2a) (PTR(32 word) x2) n () x2 x2a proof (prove)
goal (4 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf rv' x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) x2a; sendBuf = PTR(32 word) x2; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; rv' = word_of_nat (length TCB_H.msgRegisters); sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (length [1 + word_of_nat (length TCB_H.msgRegisters) .e. n])) i_' (\<lambda>a b. \<lbrace>min n b = b && mask msgLengthBits\<rbrace>)
 2. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. (sendBuffer = None \<longrightarrow> True) \<and> (\<forall>x. sendBuffer = Some x \<longrightarrow> (recvBuffer = None \<longrightarrow> True) \<and> (\<forall>x. recvBuffer = Some x \<longrightarrow> (unat na \<le> length TCB_H.msgRegisters \<longrightarrow> True) \<and> (\<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> (valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace' and (\<lambda>a. True)) s)))\<rbrace>
 3. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (\<lambda>rv rv'. {s. sendBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. sendBuffer = Some x \<longrightarrow> s \<in> {s. recvBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. recvBuffer = Some x \<longrightarrow> s \<in> {s. unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> \<lbrace>rv' = \<acute>i && mask msgLengthBits\<rbrace> \<inter> - \<lbrace>\<acute>i < rv'\<rbrace>} \<inter> {s. \<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = rv'\<rbrace>}}}}})
 4. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV proof (prove)
goal (4 subgoals):
 1. \<And>x2 x2a. \<lbrakk>unat n \<le> msgMaxLength; x2a \<noteq> 0; x2 \<noteq> 0; n = n && mask msgLengthBits; length TCB_H.msgRegisters < 2 ^ word_bits; sendBuffer = Some x2; recvBuffer = Some x2a; \<not> unat n \<le> length TCB_H.msgRegisters\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length TCB_H.msgRegisters) + word_of_nat (Suc (unat n) - unat (1 + word_of_nat (length TCB_H.msgRegisters)))) i_' (\<lambda>a b. if min n b = b && mask msgLengthBits then UNIV else {})
 2. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. (sendBuffer = None \<longrightarrow> True) \<and> (\<forall>x. sendBuffer = Some x \<longrightarrow> (recvBuffer = None \<longrightarrow> True) \<and> (\<forall>x. recvBuffer = Some x \<longrightarrow> (unat na \<le> length TCB_H.msgRegisters \<longrightarrow> True) \<and> (\<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> (valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace' and (\<lambda>a. True)) s)))\<rbrace>
 3. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (\<lambda>rv rv'. {s. sendBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. sendBuffer = Some x \<longrightarrow> s \<in> {s. recvBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. recvBuffer = Some x \<longrightarrow> s \<in> {s. unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> \<lbrace>rv' = \<acute>i && mask msgLengthBits\<rbrace> \<inter> - \<lbrace>\<acute>i < rv'\<rbrace>} \<inter> {s. \<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = rv'\<rbrace>}}}}})
 4. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV proof (prove)
goal (3 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. (sendBuffer = None \<longrightarrow> True) \<and> (\<forall>x. sendBuffer = Some x \<longrightarrow> (recvBuffer = None \<longrightarrow> True) \<and> (\<forall>x. recvBuffer = Some x \<longrightarrow> (unat na \<le> length TCB_H.msgRegisters \<longrightarrow> True) \<and> (\<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> (valid_ipc_buffer_ptr' (the sendBuffer) and valid_ipc_buffer_ptr' (the recvBuffer) and valid_pspace' and (\<lambda>a. True)) s)))\<rbrace>
 2. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (\<lambda>rv rv'. {s. sendBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. sendBuffer = Some x \<longrightarrow> s \<in> {s. recvBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. recvBuffer = Some x \<longrightarrow> s \<in> {s. unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> \<lbrace>rv' = \<acute>i && mask msgLengthBits\<rbrace> \<inter> - \<lbrace>\<acute>i < rv'\<rbrace>} \<inter> {s. \<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = rv'\<rbrace>}}}}})
 3. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV proof (prove)
goal (3 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); n = n && mask msgLengthBits; min (length TCB_H.msgRegisters) (unat n) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> \<lbrace>?R1464 (tcb_ptr_to_ctcb_ptr receiver) (tcb_ptr_to_ctcb_ptr sender) (PTR(32 word) (option_to_0 recvBuffer)) (PTR(32 word) (option_to_0 sendBuffer)) n\<rbrace> mapM_x (\<lambda>r. do v <- asUser sender (getRegister r);
asUser receiver (setRegister r v)
od) (take (unat n) TCB_H.msgRegisters) \<lbrace>\<lambda>rv s. \<forall>x. sendBuffer = Some x \<longrightarrow> (\<forall>xa. recvBuffer = Some xa \<longrightarrow> \<not> unat n \<le> length TCB_H.msgRegisters \<longrightarrow> valid_ipc_buffer_ptr' x s \<and> valid_ipc_buffer_ptr' xa s \<and> valid_pspace' s)\<rbrace>
 2. \<And>receivera sendera recvBuf sendBuf na. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; length (take (unat n) TCB_H.msgRegisters) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (length (take (unat n) TCB_H.msgRegisters))) i_' (\<lambda>rv rv'. {s. sendBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. sendBuffer = Some x \<longrightarrow> s \<in> {s. recvBuffer = None \<longrightarrow> s \<in> \<lbrace>min na rv' = rv' && mask msgLengthBits\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> {s. \<forall>x. s \<in> {s. recvBuffer = Some x \<longrightarrow> s \<in> {s. unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> \<lbrace>rv' = \<acute>i && mask msgLengthBits\<rbrace> \<inter> - \<lbrace>\<acute>i < rv'\<rbrace>} \<inter> {s. \<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> s \<in> \<lbrace>\<acute>i = rv'\<rbrace>}}}}})
 3. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R1464 receivera sendera recvBuf sendBuf na and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV proof (prove)
goal (2 subgoals):
 1. \<And>receivera sendera recvBuf sendBuf. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); n = n && mask msgLengthBits; min (length TCB_H.msgRegisters) (unat n) < 2 ^ word_bits\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat (min (length TCB_H.msgRegisters) (unat n))) i_' (\<lambda>rv rv'. {s. sendBuffer = None \<longrightarrow> s \<in> (if min n rv' = rv' && mask msgLengthBits then UNIV else {})} \<inter> {s. (\<exists>x. sendBuffer = Some x) \<longrightarrow> (recvBuffer = None \<longrightarrow> s \<in> (if min n rv' = rv' && mask msgLengthBits then UNIV else {})) \<and> ((\<exists>x. recvBuffer = Some x) \<longrightarrow> (unat n \<le> length TCB_H.msgRegisters \<longrightarrow> rv' = i_' s && mask msgLengthBits \<and> \<not> i_' s < rv') \<and> (\<not> unat n \<le> length TCB_H.msgRegisters \<longrightarrow> i_' s = rv'))})
 2. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. \<forall>x. sendBuffer = Some x \<longrightarrow> (\<forall>xa. recvBuffer = Some xa \<longrightarrow> \<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> valid_ipc_buffer_ptr' x a \<and> valid_ipc_buffer_ptr' xa a \<and> valid_pspace' a)) and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>4 \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; n = n && 0x7F; 4 < 2 ^ word_bits; unat n = 4; n \<noteq> 4; i_' s = 4\<rbrakk> \<Longrightarrow> (\<exists>y. sendBuffer = Some y) \<and> ((\<exists>x. sendBuffer = Some x) \<longrightarrow> (\<exists>y. recvBuffer = Some y))
 2. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. \<forall>x. sendBuffer = Some x \<longrightarrow> (\<forall>xa. recvBuffer = Some xa \<longrightarrow> \<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> valid_ipc_buffer_ptr' x a \<and> valid_ipc_buffer_ptr' xa a \<and> valid_pspace' a)) and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV proof (prove)
goal (1 subgoal):
 1. \<And>receivera sendera recvBuf sendBuf na s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; receivera = tcb_ptr_to_ctcb_ptr receiver; sendera = tcb_ptr_to_ctcb_ptr sender; recvBuf = PTR(32 word) (option_to_0 recvBuffer); sendBuf = PTR(32 word) (option_to_0 sendBuffer); na = na && mask msgLengthBits \<and> na = n; (s, s') \<in> rf_sr; (valid_pspace' and tcb_at' sender and tcb_at' receiver and (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) and (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x)) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. \<forall>x. sendBuffer = Some x \<longrightarrow> (\<forall>xa. recvBuffer = Some xa \<longrightarrow> \<not> unat na \<le> length TCB_H.msgRegisters \<longrightarrow> valid_ipc_buffer_ptr' x a \<and> valid_ipc_buffer_ptr' xa a \<and> valid_pspace' a)) and (\<lambda>_. length (take (unat na) TCB_H.msgRegisters) < 2 ^ word_bits)) s \<and> s' \<in> UNIV proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>unat n \<le> msgMaxLength; recvBuffer \<noteq> Some 0; sendBuffer \<noteq> Some 0; n = n && mask 7; (s, s') \<in> rf_sr; valid_pspace' s; tcb_at' sender s; tcb_at' receiver s; (case sendBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s; (case recvBuffer of None \<Rightarrow> \<lambda>_. True | Some x \<Rightarrow> valid_ipc_buffer_ptr' x) s\<rbrakk> \<Longrightarrow> (\<forall>x. sendBuffer = Some x \<longrightarrow> (\<forall>xa. recvBuffer = Some xa \<longrightarrow> \<not> unat n \<le> 4 \<longrightarrow> valid_ipc_buffer_ptr' x s \<and> valid_ipc_buffer_ptr' xa s)) \<and> (if 4 \<le> unat n then 4 else unat n) < 4294967296 proof (prove)
goal:
No subgoals!